CVE-2021-29525: Division by 0 in TensorFlow
Summary
CVE-2021-29525: Division by 0 in Conv2DBackpropInput. Affects tensorflow across 4 version ranges.
< 2.1.4
>= 2.2.0, < 2.2.3
>= 2.3.0, < 2.3.3
>= 2.4.0, < 2.4.2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- tensorflow · Bitnami
- tensorflow-cpu · PyPI
- tensorflow-gpu · PyPI
The same CVE-2021-29525 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open-source machine learning framework widely used for building and training various deep learning models. It provides a comprehensive set of tools and libraries for numerical computation and data flow graphs. TensorFlow is vulnerable to a division by 0 in the Conv2DBackpropInput function, which can be triggered by a malicious attacker.
Vulnerability Detail
The vulnerability arises due to a division by 0 in the Conv2DBackpropInput function of TensorFlow. An attacker can exploit this by providing specific input tensors that lead to a division by 0 during the execution of the function. The vulnerable code can be found in the TensorFlow source code. The impact of this vulnerability can result in a denial of service (DoS) condition, causing the affected TensorFlow application to crash or become unresponsive.
How To Fix
Latest published version: 2.21.0 as of 22 Oct 2026
pip install --upgrade "tensorflow==2.21.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.1.42.1.4pip install --upgrade "tensorflow==2.1.4" -
>= 2.2.0, < 2.2.32.2.3pip install --upgrade "tensorflow==2.2.3" -
>= 2.3.0, < 2.3.32.3.3pip install --upgrade "tensorflow==2.3.3" -
>= 2.4.0, < 2.4.22.4.2pip install --upgrade "tensorflow==2.4.2"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround available for this vulnerability. It is recommended to update to the patched version of TensorFlow.
Conclusion
The division by 0 vulnerability in TensorFlow can be exploited by an attacker to cause a denial of service (DoS) condition. It is crucial to update to TensorFlow version 2.5.0 or later to mitigate this vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
The vulnerability can lead to a division by 0, resulting in a denial of service (DoS) condition in the affected TensorFlow application.
To fix the vulnerability, update your TensorFlow installation to version 2.5.0 or later.
No, there is no specific workaround available. Updating to the patched version is the recommended solution.
The vulnerability affects TensorFlow versions 0 to 2.1.4, 2.2.0 to 2.2.3, 2.3.0 to 2.3.3, and 2.4.0 to 2.4.2.
The vulnerability was reported by Yakun Zhang and Ying Wang of Baidu X-Team.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
