CVE-2021-29601: TensorFlow Integer Overflow in TFLite Concatenation
Summary
CVE-2021-29601: TensorFlow is an end-to-end open source platform for machine learning. Affects tensorflow across 5 version ranges.
< 2.1.4
>= 2.2.0, < 2.2.3
>= 2.3.0, < 2.3.3
>= 2.4.0, < 2.4.2
< 4253f96a58486ffe84b61c0415bb234a4632ee73
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- tensorflow · Bitnami
- tensorflow-cpu · PyPI
- tensorflow-gpu · PyPI
The same CVE-2021-29601 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an end-to-end open source platform for machine learning. It provides a comprehensive ecosystem of tools, libraries, and community resources that enable researchers and developers to build and deploy machine learning models. TFLite is a lightweight version of TensorFlow designed for mobile and embedded devices. It allows developers to run TensorFlow models on resource-constrained platforms. The vulnerability in TFLite's concatenation implementation can lead to an integer overflow issue.
Vulnerability Detail
The TFLite implementation of concatenation in TensorFlow is vulnerable to an integer overflow issue. This vulnerability arises due to the use of int to represent tensor dimensions in TFLite, while TF uses int64. An attacker can exploit this vulnerability by crafting a malicious model in which the dimensions of one of the concatenation inputs exceed the maximum value of int. When such a model is converted to TFLite format, it triggers an integer overflow. This vulnerability affects TensorFlow versions 2.1.4 and above.
How To Fix
Latest published version: 2.21.0 as of 22 Oct 2026
pip install --upgrade "tensorflow==2.21.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.1.42.1.4pip install --upgrade "tensorflow==2.1.4" -
>= 2.2.0, < 2.2.32.2.3pip install --upgrade "tensorflow==2.2.3" -
>= 2.3.0, < 2.3.32.3.3pip install --upgrade "tensorflow==2.3.3" -
>= 2.4.0, < 2.4.22.4.2pip install --upgrade "tensorflow==2.4.2"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update to the fixed versions of TensorFlow as mentioned in the 'how_to_fix' section.
Conclusion
The vulnerability in TensorFlow's TFLite implementation of concatenation can be exploited through crafted input dimensions, leading to an integer overflow. To mitigate this vulnerability, users should update their TensorFlow installations to the fixed versions mentioned in the 'how_to_fix' section. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
TensorFlow is an open source platform for machine learning that provides tools and libraries for building and deploying machine learning models.
TFLite is a lightweight version of TensorFlow designed for running models on resource-constrained platforms such as mobile and embedded devices.
The vulnerability occurs due to an integer overflow issue in the TFLite implementation of concatenation. It arises from the use of int to represent tensor dimensions, which can be exceeded by crafted input dimensions.
Exploiting this vulnerability can lead to various consequences depending on the context. It could potentially result in memory corruption, crashes, or even remote code execution.
No, only TensorFlow versions 2.1.4 and above are affected by this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
