CVE-2022-23582: Denial of Service Vulnerability in TensorFlow
Summary
CVE-2022-23582: Tensorflow is an Open Source Machine Learning Framework. Affects tensorflow-cpu across 3 version ranges.
< 2.5.3
>= 2.6.0, < 2.6.3
< c2426bba00a01de6913738df8fa78e0215fcce02
Fixed in 2.5.3 or 2.6.3, depending on the release line you run. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow · Bitnami
- tensorflow · PyPI
- tensorflow-gpu · PyPI
The same CVE-2022-23582 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open-source machine learning framework widely used for developing and deploying machine learning models. It provides a comprehensive ecosystem for building and training various types of neural networks. TensorFlow is written in Python and supports multiple programming languages. It is known for its scalability, flexibility, and extensive library of pre-built models and tools. However, a vulnerability has been discovered in TensorFlow that can lead to a denial of service (DoS) attack.
Vulnerability Detail
The vulnerability in TensorFlow arises from a flaw in the handling of SavedModel objects. By manipulating the SavedModel in a specific way, an attacker can trigger CHECK failures in the TensorShape constructor. This constructor throws a CHECK-fail if the shape is partial or if the number of elements exceeds the size of an int. The PartialTensorShape constructor, on the other hand, does not cause a CHECK-abort if the shape is partial. Exploiting this difference, an attacker can craft a SavedModel that causes a DoS by triggering these CHECK failures. The impact of this vulnerability can be severe, as it can lead to the unavailability of TensorFlow services and disrupt machine learning workflows.
How To Fix
Latest published version: 2.21.0 as of 22 Oct 2026
pip install --upgrade "tensorflow-cpu==2.21.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.5.32.5.3pip install --upgrade "tensorflow-cpu==2.5.3" -
>= 2.6.0, < 2.6.32.6.3pip install --upgrade "tensorflow-cpu==2.6.3"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can consider implementing input validation and sanitization mechanisms to detect and reject maliciously crafted SavedModel objects. By carefully inspecting the shape and size of the tensors in a SavedModel, it may be possible to identify and discard potentially malicious inputs. However, this workaround is not foolproof and should only be considered as a temporary measure until the patched versions of TensorFlow are available.
Conclusion
The vulnerability in TensorFlow can lead to a denial of service (DoS) attack by exploiting a flaw in the handling of SavedModel objects. It is crucial for TensorFlow users to update their installations to the patched versions as soon as they are released. In the meantime, implementing input validation and sanitization mechanisms can provide temporary protection. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow-cpu →
FAQ
TensorFlow is an open-source machine learning framework used for developing and deploying machine learning models. It provides a comprehensive ecosystem for building and training various types of neural networks.
A SavedModel is a serialization format used in TensorFlow to save and restore trained models. It contains the model's architecture, weights, and other necessary information for inference or further training.
This vulnerability can lead to a denial of service (DoS) attack by causing CHECK failures in the TensorShape constructor. It can result in the unavailability of TensorFlow services and disrupt machine learning workflows.
No, the vulnerability affects TensorFlow versions 2.5.3, 2.6.3, 2.7.1, and earlier. The fix will be included in TensorFlow 2.8.0 and backported to the affected versions.
To protect your TensorFlow installation, it is crucial to update to the patched versions (2.8.0, 2.7.1, 2.6.3, or 2.5.3) as soon as they become available. Additionally, implementing input validation and sanitization mechanisms can serve as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow-cpu.
