CVE-2021-37688: TensorFlow-CPU Null Pointer Dereference Denial of Service
Summary
CVE-2021-37688: TensorFlow is an end-to-end open source platform for machine learning. Affects tensorflow-cpu across 3 version ranges.
>= 2.3.0, < 2.3.4
>= 2.4.0, < 2.4.3
< 15691e456c7dc9bd6be203b09765b063bf4a380c
Fixed in 2.3.4 or 2.4.3, depending on the release line you run. How to fix ↓
Also tracked for
- tensorflow · Bitnami
- tensorflow · PyPI
- tensorflow · PyPI
- tensorflow-gpu · PyPI
The same CVE-2021-37688 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an end-to-end open source platform for machine learning. It provides a comprehensive ecosystem of tools, libraries, and resources for developing and deploying machine learning models. TensorFlow-CPU is a Python package that allows users to run TensorFlow on CPUs. It is widely used in various industries and research domains for machine learning tasks. However, a vulnerability has been discovered in TensorFlow-CPU that can lead to a denial of service (DoS) attack.
Vulnerability Detail
The vulnerability (CVE-2021-37688) in TensorFlow-CPU allows an attacker to craft a TFLite model that triggers a null pointer dereference. This results in a crash of the application and a denial of service. The issue lies in the unconditionally dereferencing of a pointer in the optimized_ops.h file of the TensorFlow codebase. The vulnerability can be exploited by an attacker with the ability to provide a malicious TFLite model to the affected application. The impact of this vulnerability is the disruption of service and potential loss of data.
How To Fix
Latest published version: 2.21.0 as of 22 Oct 2026
pip install --upgrade "tensorflow-cpu==2.21.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.3.0, < 2.3.42.3.4pip install --upgrade "tensorflow-cpu==2.3.4" -
>= 2.4.0, < 2.4.32.4.3pip install --upgrade "tensorflow-cpu==2.4.3"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The recommended solution is to update the TensorFlow-CPU package to the latest version as mentioned in the 'how_to_fix' section.
Conclusion
The vulnerability in TensorFlow-CPU (CVE-2021-37688) allows an attacker to trigger a null pointer dereference, leading to a denial of service. To mitigate this vulnerability, users should update their TensorFlow-CPU package to the latest version once it becomes available. Regularly checking for updates and applying them promptly is crucial for maintaining the security of the application. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for tensorflow-cpu →
FAQ
The vulnerability can lead to a denial of service (DoS) attack, causing the affected application to crash and potentially resulting in the loss of data.
Users of TensorFlow-CPU versions 2.3.0 to 2.3.4, 2.4.0 to 2.4.3, and 2.5.1 are affected by this vulnerability.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Pipfile.lock and it will analyze and alert you in real-time.
Yes, the vulnerability has been patched in the TensorFlow codebase with the commit 15691e456c7dc9bd6be203b09765b063bf4a380c. The fix will be included in TensorFlow 2.6.0.
It is recommended to update your TensorFlow-CPU package to the latest version once it becomes available. Regularly check for updates and apply them promptly to ensure the security of your application.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow-cpu.
