CVE-2022-21734: TensorFlow CPU - MapStage Key Tensor Vulnerability

tensorflow-cpu Updated 02 Oct 2025

Summary

03/02/2022

Disclosed on

CVE-2022-21734

CVE

Yes i

Fix available

Unrated

Severity

Not published

CVSS Score

CVE-2022-21734: Tensorflow is an Open Source Machine Learning Framework. Affects tensorflow-cpu across 3 version ranges.

< 2.5.3 >= 2.6.0, < 2.6.3 < f57315566d7094f322b784947093406c2aea0d7d

Fixed in 2.5.3 or 2.6.3, depending on the release line you run. How to fix ↓

Also tracked for

tensorflow · PyPI
tensorflow · Bitnami
tensorflow · PyPI
tensorflow-gpu · PyPI

The same CVE-2022-21734 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

TensorFlow is an open-source machine learning framework widely used for developing and deploying machine learning models. It provides a comprehensive set of tools and libraries for building and training neural networks. TensorFlow CPU is a specific package that focuses on the CPU implementation of TensorFlow. It is commonly used in environments where GPU acceleration is not available or required. TensorFlow CPU allows users to leverage the power of TensorFlow on CPUs for machine learning tasks.

Vulnerability Detail

The vulnerability identified as CVE-2022-21734 affects the MapStage implementation in TensorFlow. When the key tensor is not a scalar, a CHECK-fail occurs, leading to a potential security issue. This vulnerability can be exploited by an attacker to cause a denial of service (DoS) or potentially execute arbitrary code. The vulnerability has been assigned a severity rating of high. It affects versions of TensorFlow CPU up to and including 2.5.3, 2.6.3, and 2.7.1. The TensorFlow development team has addressed this vulnerability in TensorFlow 2.8.0 and has also backported the fix to the affected versions.

How To Fix

Latest published version: 2.21.0 as of 22 Oct 2026

pip install --upgrade "tensorflow-cpu==2.21.0"

Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.

If you can't move to the latest

The minimum fixed version depends on the release line you run.

< 2.5.3 2.5.3

pip install --upgrade "tensorflow-cpu==2.5.3"

>= 2.6.0, < 2.6.3 2.6.3

pip install --upgrade "tensorflow-cpu==2.6.3"

Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →

Workaround

There is no specific workaround provided for this vulnerability. The recommended approach is to upgrade to the fixed version of TensorFlow CPU.

Conclusion

The MapStage Key Tensor Vulnerability in TensorFlow CPU poses a significant security risk, potentially leading to a denial of service or arbitrary code execution. It is crucial to promptly update to the fixed version of TensorFlow CPU (2.8.0) or apply the corresponding patched versions (2.5.4, 2.6.3, or 2.7.1) to mitigate this vulnerability. Regularly updating your TensorFlow CPU installation is essential to ensure the latest security patches and bug fixes are in place. For further support on vulnerability remediation, you can reach out to DevNack.com.

See every vulnerability recorded for tensorflow-cpu →

FAQ

What is TensorFlow CPU?

TensorFlow CPU is a package that provides the CPU implementation of the TensorFlow machine learning framework. It allows users to utilize TensorFlow on CPUs for machine learning tasks when GPU acceleration is not available or required.

What is the MapStage implementation in TensorFlow?

MapStage is a component in TensorFlow that is used for mapping operations over a dataset. It is commonly used in machine learning pipelines for preprocessing and transforming data.

What is the impact of this vulnerability?

This vulnerability can potentially lead to a denial of service (DoS) or arbitrary code execution. An attacker could exploit this vulnerability to disrupt TensorFlow CPU operations or execute malicious code on a vulnerable system.

Which versions of TensorFlow CPU are affected?

Versions of TensorFlow CPU up to and including 2.5.3, 2.6.3, and 2.7.1 are affected by this vulnerability.

How can I check if my application is affected by this vulnerability?

You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, and you can check the impact of this vulnerability without any signup or installation.

References

Related vulnerabilities

Recent vulnerabilities recorded for tensorflow-cpu.

View all tensorflow-cpu vulnerabilities →