CVE-2022-21735: TensorFlow FractionalMaxPool Division by 0
Summary
CVE-2022-21735: Tensorflow is an Open Source Machine Learning Framework. Affects tensorflow-cpu across 3 version ranges.
< 2.5.3
>= 2.6.0, < 2.6.3
< ba4e8ac4dc2991e350d5cc407f8598c8d4ee70fb
Fixed in 2.5.3 or 2.6.3, depending on the release line you run. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow · Bitnami
- tensorflow · PyPI
- tensorflow-gpu · PyPI
The same CVE-2022-21735 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open-source machine learning framework widely used for developing and deploying machine learning models. It provides a comprehensive set of tools and libraries for building and training neural networks. TensorFlow is available on PyPI as the 'tensorflow-cpu' package.
Vulnerability Detail
The vulnerability (CVE-2022-21735) in TensorFlow arises from a flaw in the implementation of the 'FractionalMaxPool' function. This flaw can be exploited to crash a TensorFlow process by triggering a division by zero error. An attacker could potentially exploit this vulnerability to disrupt TensorFlow-based applications or cause denial of service. The vulnerability affects versions 0 and above of the 'tensorflow-cpu' package.
How To Fix
Latest published version: 2.21.0 as of 22 Oct 2026
pip install --upgrade "tensorflow-cpu==2.21.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.5.32.5.3pip install --upgrade "tensorflow-cpu==2.5.3" -
>= 2.6.0, < 2.6.32.6.3pip install --upgrade "tensorflow-cpu==2.6.3"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
No specific workaround has been provided for this vulnerability.
Conclusion
The vulnerability in TensorFlow's 'FractionalMaxPool' function (CVE-2022-21735) has been addressed in TensorFlow 2.8.0. Users are strongly advised to update their 'tensorflow-cpu' package to the fixed version to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow-cpu →
FAQ
TensorFlow is an open-source machine learning framework used for building and training neural networks.
The 'FractionalMaxPool' function is a feature in TensorFlow that performs a fractional max pooling operation on the input tensor.
This vulnerability can be exploited to crash TensorFlow processes, potentially leading to disruption of TensorFlow-based applications or denial of service.
The vulnerability affects versions 0 and above of the 'tensorflow-cpu' package. Specifically, versions 2.5.3, 2.6.3, and 2.7.1 are also affected.
To fix the vulnerability, update your 'tensorflow-cpu' package to version 2.8.0 or later. Alternatively, if you are on versions 2.5.3, 2.6.3, or 2.7.1, update to the respective fixed versions.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow-cpu.
