CVE-2022-23565: Denial of Service Vulnerability in TensorFlow
Summary
CVE-2022-23565: Tensorflow is an Open Source Machine Learning Framework. Affects tensorflow-cpu across 3 version ranges.
< 2.5.3
>= 2.6.0, < 2.6.3
< c2b31ff2d3151acb230edc3f5b1832d2c713a9e0
Fixed in 2.5.3 or 2.6.3, depending on the release line you run. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow · Bitnami
- tensorflow · PyPI
- tensorflow-gpu · PyPI
The same CVE-2022-23565 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open-source machine learning framework widely used for developing and deploying machine learning models. It provides a comprehensive ecosystem for building and training various types of neural networks. TensorFlow is available as a Python package and supports both CPU and GPU computations. It is widely adopted in research and production environments for tasks such as image recognition, natural language processing, and recommendation systems.
Vulnerability Detail
A vulnerability has been discovered in TensorFlow that allows an attacker to trigger a denial of service (DoS) attack by manipulating a SavedModel on disk. By duplicating AttrDefs of certain operations within the SavedModel, the attacker can cause an assertion failure, leading to a crash or unresponsiveness of the TensorFlow application. This vulnerability can be exploited remotely, potentially impacting any system or application that utilizes TensorFlow models. The issue has been assigned CVE-2022-23565.
How To Fix
Latest published version: 2.21.0 as of 22 Oct 2026
pip install --upgrade "tensorflow-cpu==2.21.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.5.32.5.3pip install --upgrade "tensorflow-cpu==2.5.3" -
>= 2.6.0, < 2.6.32.6.3pip install --upgrade "tensorflow-cpu==2.6.3"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
No specific workaround has been provided for this vulnerability. It is advised to follow the recommended steps for fixing the vulnerability by updating to the latest version of TensorFlow.
Conclusion
A denial of service vulnerability has been identified in TensorFlow that can be exploited by manipulating a SavedModel on disk. This vulnerability has been assigned CVE-2022-23565 and can lead to a crash or unresponsiveness of TensorFlow applications. The TensorFlow development team has addressed this issue in the upcoming release of TensorFlow 2.8.0 and has backported the fix to earlier versions. It is crucial to update to the latest version of TensorFlow to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow-cpu →
FAQ
TensorFlow is an open-source machine learning framework used for developing and deploying machine learning models. It provides a comprehensive ecosystem for building and training various types of neural networks.
This vulnerability allows an attacker to trigger a denial of service (DoS) attack by manipulating a SavedModel on disk. It can lead to a crash or unresponsiveness of the TensorFlow application.
Yes, this vulnerability can be exploited remotely, potentially impacting any system or application that utilizes TensorFlow models.
The vulnerability affects TensorFlow versions 2.5.3, 2.6.3, 2.7.1, and earlier. The upcoming release of TensorFlow 2.8.0 will include the fix for this vulnerability.
To fix this vulnerability, it is recommended to update to the latest available version of TensorFlow, which includes the necessary security patches.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow-cpu.
