CVE-2020-26266: TensorFlow-CPU Uninitialized Value Use Vulnerability

tensorflow-cpu Updated 02 Oct 2025

Summary

10/12/2020

Disclosed on

CVE-2020-26266

CVE

Yes i

Fix available

Unrated

Severity

Not published

CVSS Score

CVE-2020-26266: In affected versions of TensorFlow under certain cases a saved model can trigger use of uninitialized values during code execution. Affects tensorflow-cpu across 6 version ranges.

< 1.15.5 >= 2.0.0, < 2.0.4 >= 2.1.0, < 2.1.3 >= 2.2.0, < 2.2.2 >= 2.3.0, < 2.3.2 < ace0c15a22f7f054abcc1f53eabbcb0a1239a9e2

Fixed in 5 releases; the minimum fixed version depends on the release line you run. How to fix ↓

Also tracked for

tensorflow · Bitnami
tensorflow · PyPI
tensorflow-gpu · PyPI
tensorflow · PyPI

The same CVE-2020-26266 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

TensorFlow is an open-source machine learning framework developed by Google. It provides a comprehensive ecosystem of tools, libraries, and community resources that allow researchers and developers to build and deploy machine learning models. TensorFlow-CPU is a variant of TensorFlow specifically optimized for running on CPUs. It is widely used in various applications, including image recognition, natural language processing, and deep learning. However, certain versions of TensorFlow-CPU are vulnerable to an uninitialized value use issue.

Vulnerability Detail

The vulnerability (CVE-2020-26266) in TensorFlow-CPU arises when a saved model triggers the use of uninitialized values during code execution. This occurs due to tensor buffers being filled with the default value of the type, but the quantized floating point types in Eigen are not properly default initialized. An attacker could potentially exploit this vulnerability to manipulate the uninitialized values and cause unexpected behavior or crashes in TensorFlow-CPU. The vulnerability has been fixed in versions 1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, and 2.4.0 of TensorFlow-CPU.

How To Fix

Latest published version: 2.21.0 as of 22 Oct 2026

pip install --upgrade "tensorflow-cpu==2.21.0"

Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.

If you can't move to the latest

The minimum fixed version depends on the release line you run.

< 1.15.5 1.15.5

pip install --upgrade "tensorflow-cpu==1.15.5"

>= 2.0.0, < 2.0.4 2.0.4

pip install --upgrade "tensorflow-cpu==2.0.4"

>= 2.1.0, < 2.1.3 2.1.3

pip install --upgrade "tensorflow-cpu==2.1.3"

>= 2.2.0, < 2.2.2 2.2.2

pip install --upgrade "tensorflow-cpu==2.2.2"

>= 2.3.0, < 2.3.2 2.3.2

pip install --upgrade "tensorflow-cpu==2.3.2"

Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →

Workaround

There is no known workaround for this vulnerability. It is crucial to update TensorFlow-CPU to a fixed version to mitigate the risk.

Conclusion

The vulnerability in TensorFlow-CPU (CVE-2020-26266) allows uninitialized values to be used during code execution, potentially leading to unexpected behavior or crashes. It is crucial to update TensorFlow-CPU to one of the fixed versions (1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, or 2.4.0) to mitigate the risk. For further support on vulnerability remediation, you can reach out to DevNack.com.

See every vulnerability recorded for tensorflow-cpu →

FAQ

What is TensorFlow-CPU?

TensorFlow-CPU is a variant of TensorFlow optimized for running on CPUs. It provides similar functionality to TensorFlow but is designed to leverage the computational power of CPUs instead of GPUs.

What is the impact of this vulnerability?

The vulnerability could allow an attacker to manipulate uninitialized values during code execution, potentially leading to unexpected behavior or crashes in TensorFlow-CPU.

How can I check if my TensorFlow-CPU installation is affected?

You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your Pipfile.lock, and Vulert will analyze it for open-source vulnerabilities, including this one.

Are there any known workarounds?

No, there are no known workarounds for this vulnerability. It is essential to update TensorFlow-CPU to a fixed version.

Where can I find more information about this vulnerability?

You can find more information about this vulnerability in the TensorFlow-CPU advisory database: https://github.com/pypa/advisory-database/blob/main/vulns/tensorflow-cpu/PYSEC-2020-297.yaml

References

Related vulnerabilities

Recent vulnerabilities recorded for tensorflow-cpu.

View all tensorflow-cpu vulnerabilities →