CVE-2022-23579: Denial of Service Vulnerability in TensorFlow
Summary
CVE-2022-23579: Tensorflow is an Open Source Machine Learning Framework. Affects tensorflow-cpu across 3 version ranges.
< 2.5.3
>= 2.6.0, < 2.6.3
< 92dba16749fae36c246bec3f9ba474d9ddeb7662
Fixed in 2.5.3 or 2.6.3, depending on the release line you run. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow · Bitnami
- tensorflow · PyPI
- tensorflow-gpu · PyPI
The same CVE-2022-23579 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
TensorFlow is an open-source machine learning framework widely used for developing and deploying machine learning models. It provides a comprehensive ecosystem of tools, libraries, and resources for building and training neural networks. TensorFlow supports various platforms and is known for its scalability and flexibility. However, a vulnerability has been discovered in TensorFlow that can lead to a denial of service (DoS) attack.
Vulnerability Detail
The vulnerability exists in the Grappler optimizer component of TensorFlow. By manipulating a SavedModel, an attacker can trigger CHECK failures in the SafeToRemoveIdentity function of the optimizer. This can result in a DoS condition, causing the affected TensorFlow application to become unresponsive or crash. The vulnerability has been assigned CVE-2022-23579 and has been reported to the TensorFlow development team.
How To Fix
Latest published version: 2.21.0 as of 22 Oct 2026
pip install --upgrade "tensorflow-cpu==2.21.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.5.32.5.3pip install --upgrade "tensorflow-cpu==2.5.3" -
>= 2.6.0, < 2.6.32.6.3pip install --upgrade "tensorflow-cpu==2.6.3"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
No specific workaround has been provided for this vulnerability. The recommended solution is to update to the patched versions of TensorFlow as mentioned in the 'how_to_fix' section.
Conclusion
A denial of service vulnerability has been identified in TensorFlow, specifically in the Grappler optimizer. This vulnerability can be exploited to cause TensorFlow applications to become unresponsive or crash. Users are advised to update their TensorFlow installations to the patched versions mentioned in the 'how_to_fix' section. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for tensorflow-cpu →
FAQ
TensorFlow is an open-source machine learning framework used for developing and deploying machine learning models.
The Grappler optimizer is a component in TensorFlow that optimizes the computational graph of a machine learning model for improved performance.
A denial of service attack is a malicious attempt to disrupt the normal functioning of a network, system, or application by overwhelming it with a flood of illegitimate requests or resource consumption.
This vulnerability can lead to a denial of service condition in TensorFlow applications, causing them to become unresponsive or crash.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow-cpu.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
