CVE-2021-29588: TensorFlow-CPU - Division by Zero Vulnerability
Summary
CVE-2021-29588: TensorFlow is an end-to-end open source platform for machine learning. Affects tensorflow-cpu across 5 version ranges.
< 2.1.4
>= 2.2.0, < 2.2.3
>= 2.3.0, < 2.3.3
>= 2.4.0, < 2.4.2
< 801c1c6be5324219689c98e1bd3e0ca365ee834d
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- tensorflow · Bitnami
- tensorflow · PyPI
- tensorflow · PyPI
- tensorflow-gpu · PyPI
The same CVE-2021-29588 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an end-to-end open source platform for machine learning. It provides a comprehensive ecosystem of tools, libraries, and resources for developing and deploying machine learning models. TensorFlow-CPU is a specific package that focuses on running TensorFlow on CPUs. It is widely used in various industries for machine learning tasks.
Vulnerability Detail
The optimized implementation of the TransposeConv TFLite operator in TensorFlow-CPU is vulnerable to a division by zero error. This vulnerability can be exploited by an attacker who crafts a malicious model with stride_{h,w} values set to 0. When the vulnerable code is executed, a division by zero occurs, leading to a potential crash or other unintended behavior. This vulnerability affects versions 0 and above of the TensorFlow-CPU package.
How To Fix
Latest published version: 2.21.0 as of 22 Oct 2026
pip install --upgrade "tensorflow-cpu==2.21.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.1.42.1.4pip install --upgrade "tensorflow-cpu==2.1.4" -
>= 2.2.0, < 2.2.32.2.3pip install --upgrade "tensorflow-cpu==2.2.3" -
>= 2.3.0, < 2.3.32.3.3pip install --upgrade "tensorflow-cpu==2.3.3" -
>= 2.4.0, < 2.4.22.4.2pip install --upgrade "tensorflow-cpu==2.4.2"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating to the latest version is not immediately feasible, users can implement a workaround by validating the stride_{h,w} values before calling the vulnerable code. By checking if the values are non-zero, the division by zero error can be avoided. Here is an example of how to implement the workaround in Python:
stride_h = 2
stride_w = 0
if stride_h != 0 and stride_w != 0:
# Call the vulnerable code
...
Conclusion
The division by zero vulnerability in TensorFlow-CPU can be mitigated by updating to the latest version of the package. It is important to regularly update software dependencies to ensure the latest security patches and bug fixes are applied. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow-cpu →
FAQ
TensorFlow is an open source platform for machine learning that provides a comprehensive set of tools and resources for developing and deploying machine learning models.
TensorFlow-CPU is a specific package that allows running TensorFlow on CPUs. It is widely used in various industries for machine learning tasks.
The vulnerability in TensorFlow-CPU is a division by zero error in the optimized implementation of the TransposeConv TFLite operator. It can be exploited by an attacker who crafts a model with specific stride_{h,w} values set to 0.
The division by zero error can lead to a crash or other unintended behavior when executing the vulnerable code. This can potentially be exploited by an attacker to disrupt machine learning processes or gain unauthorized access.
To fix this vulnerability, update your TensorFlow-CPU package to version 2.5.0 or later. Run the command pip install --upgrade tensorflow-cpu to update the package.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow-cpu.
