CVE-2021-41197: TensorFlow - Crashes due to overflow and CHECK-fail in ops with large tensor shapes
Summary
CVE-2021-41197: Crashes due to overflow and CHECK-fail in ops with large tensor shapes. Affects tensorflow across 3 version ranges.
< 2.4.4
>= 2.5.0, < 2.5.2
>= 2.6.0, < 2.6.1
Fixed in 2.4.4, 2.5.2 or 2.6.1, depending on the release line you run. How to fix ↓
Also tracked for
- tensorflow · Bitnami
- tensorflow-cpu · PyPI
- tensorflow-gpu · PyPI
The same CVE-2021-41197 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open-source machine learning framework that provides a comprehensive ecosystem of tools, libraries, and resources for developing and deploying machine learning models. It allows tensors to have a large number of dimensions, with each dimension capable of being as large as desired. However, there is a vulnerability in TensorFlow where the total number of elements in a tensor must fit within an int64_t. If an overflow occurs, it can lead to crashes and CHECK failures in operations involving large tensor shapes.
Vulnerability Detail
The vulnerability in TensorFlow arises when a tensor has a large number of dimensions and the total number of elements exceeds the capacity of an int64_t. This can result in an overflow, causing MultiplyWithoutOverflow to return a negative result. In most cases, this negative result triggers a CHECK failure, leading to crashes in the TensorFlow binary. The vulnerability can have various ramifications, including denial of service (DoS) attacks, data corruption, and potential security breaches. The issue has been patched in TensorFlow versions 2.6.1, 2.5.2, and 2.4.4.
How To Fix
Latest published version: 2.21.0 as of 22 Oct 2026
pip install --upgrade "tensorflow==2.21.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.4.42.4.4pip install --upgrade "tensorflow==2.4.4" -
>= 2.5.0, < 2.5.22.5.2pip install --upgrade "tensorflow==2.5.2" -
>= 2.6.0, < 2.6.12.6.1pip install --upgrade "tensorflow==2.6.1"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. Updating to the patched version of TensorFlow is the recommended solution.
Conclusion
The vulnerability in TensorFlow that causes crashes and CHECK failures in operations with large tensor shapes has been addressed in the latest patched versions. It is crucial to update TensorFlow to the patched versions (2.6.1, 2.5.2, or 2.4.4) to mitigate the risk of potential security breaches and ensure the stability of TensorFlow applications. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
TensorFlow is an open-source machine learning framework that provides tools and resources for developing and deploying machine learning models.
The vulnerability can lead to crashes, CHECK failures, and potential security breaches in TensorFlow applications.
To fix the vulnerability, update TensorFlow to the latest patched version (2.6.1, 2.5.2, or 2.4.4) and replace AddDim calls with AddDimWithStatus in your codebase.
No specific workarounds are provided. Updating to the patched version is the recommended solution.
For more information about TensorFlow security, refer to the TensorFlow security guide.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
