Vulnerability in tensorflow package: UNKNOWN READ in std::pair
Summary
OSV-2021-449: UNKNOWN READ in std::pair. Affects tensorflow versions >= 0834086910de00f55876040943975e388b645e7a, < 7677422a56f18c10e3827e29dc8da8a7b23fbede. Fixed in 7677422a56f18c10e3827e29dc8da8a7b23fbede. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The tensorflow package is a popular open-source library used for machine learning and deep learning tasks. It provides a comprehensive set of tools and functions for building and training neural networks. The package is widely used in various industries and research fields.
Vulnerability Detail
This vulnerability, identified as UNKNOWN READ, affects the tensorflow package. It can lead to a crash in the std::pair<absl::lts_NUMBER_02_25::container_internal::raw_hash_set<absl::lts_NUM function, specifically in the tensorflow::SparseCount<long, long>::Compute and tensorflow::KernelAndDeviceOp::Run functions. The exact cause and impact of this vulnerability are currently unknown.
How To Fix
Latest published version: 2.21.0 as of 22 Oct 2026
pip install --upgrade "tensorflow==2.21.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7677422a56f18c10e3827e29dc8da8a7b23fbede
This is the first release that contains the fix.
pip install --upgrade "tensorflow==7677422a56f18c10e3827e29dc8da8a7b23fbede"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been provided for this vulnerability.
Conclusion
In conclusion, the tensorflow package is affected by an UNKNOWN READ vulnerability, which can result in crashes or unexpected behavior. It is recommended to update to the latest version of the package to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
The exact impact of this vulnerability is currently unknown. It may lead to crashes or other unexpected behavior in applications using the tensorflow package.
There is no information available about any known exploits for this vulnerability at the moment.
No, only versions between 0834086910de00f55876040943975e388b645e7a and 7677422a56f18c10e3827e29dc8da8a7b23fbede are affected by this vulnerability.
Yes, the vulnerability has been fixed in versions 7677422a56f18c10e3827e29dc8da8a7b23fbede and later.
You can find more information about this vulnerability in the OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31393
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
