CVE-2021-29594: TensorFlow CPU - Division by Zero Vulnerability
Summary
CVE-2021-29594: TensorFlow is an end-to-end open source platform for machine learning. Affects tensorflow-cpu across 5 version ranges.
< 2.1.4
>= 2.2.0, < 2.2.3
>= 2.3.0, < 2.3.3
>= 2.4.0, < 2.4.2
< ff489d95a9006be080ad14feb378f2b4dac35552
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- tensorflow · Bitnami
- tensorflow · PyPI
- tensorflow · PyPI
- tensorflow-gpu · PyPI
The same CVE-2021-29594 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an end-to-end open source platform for machine learning. It provides a comprehensive ecosystem of tools, libraries, and resources for developing and deploying machine learning models. TensorFlow CPU is a specific package within TensorFlow that focuses on running TensorFlow on CPUs. It is widely used in various industries and research domains for machine learning tasks.
Vulnerability Detail
The vulnerability (CVE-2021-29594) exists in the convolution code of TensorFlow Lite (TFLite). This code contains multiple divisions where the divisor is controlled by the user and is not checked to be non-zero. As a result, if a user provides a zero divisor, it can lead to a division by zero error, causing the program to crash or potentially enabling an attacker to execute arbitrary code. The vulnerability affects versions of TensorFlow CPU ranging from 0 to 2.4.2, 2.3.3, 2.2.3, and 2.1.4.
How To Fix
Latest published version: 2.21.0 as of 22 Oct 2026
pip install --upgrade "tensorflow-cpu==2.21.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.1.42.1.4pip install --upgrade "tensorflow-cpu==2.1.4" -
>= 2.2.0, < 2.2.32.2.3pip install --upgrade "tensorflow-cpu==2.2.3" -
>= 2.3.0, < 2.3.32.3.3pip install --upgrade "tensorflow-cpu==2.3.3" -
>= 2.4.0, < 2.4.22.4.2pip install --upgrade "tensorflow-cpu==2.4.2"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to update the TensorFlow CPU package to a fixed version.
Conclusion
The division by zero vulnerability in TensorFlow CPU (CVE-2021-29594) can lead to program crashes or potential execution of arbitrary code. It is crucial for users to update their TensorFlow CPU package to one of the fixed versions to mitigate the risk. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for tensorflow-cpu →
FAQ
TensorFlow CPU is a package within TensorFlow that focuses on running TensorFlow on CPUs. It provides optimized implementations of machine learning operations for CPU architectures.
The vulnerability allows for a division by zero error, which can lead to program crashes or potential execution of arbitrary code. This could be exploited by an attacker to gain unauthorized access or disrupt the system.
The vulnerability affects TensorFlow CPU versions ranging from 0 to 2.4.2, 2.3.3, 2.2.3, and 2.1.4.
To fix this vulnerability, update your TensorFlow CPU package to one of the fixed versions: TensorFlow 2.5.0, 2.4.2, 2.3.3, 2.2.3, or 2.1.4.
No specific workaround is mentioned for this vulnerability. It is recommended to update the TensorFlow CPU package to a fixed version.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow-cpu.
