CVE-2020-15192: Memory Leak in Tensorflow-gpu
Summary
CVE-2020-15192: In Tensorflow before versions 2.2.1 and 2.3.1, if a user passes a list of strings to dlpack.to_dlpack there is a memory leak following an expected validation failure. Affects tensorflow-gpu across 3 version ranges.
< 2.2.1
>= 2.3.0rc0, < 2.3.1
< 22e07fb204386768e5bcbea563641ea11f96ceb8
Fixed in 2.2.1 or 2.3.1, depending on the release line you run. How to fix ↓
Also tracked for
- tensorflow · Bitnami
- tensorflow · PyPI
- tensorflow-cpu · PyPI
- tensorflow · PyPI
The same CVE-2020-15192 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Tensorflow-gpu is a Python library for numerical computation and machine learning. It provides a flexible framework for building and training machine learning models. Tensorflow-gpu is vulnerable to a memory leak issue in versions before 2.2.1 and 2.3.1. This vulnerability occurs when a user passes a list of strings to dlpack.to_dlpack and there is a memory leak following an expected validation failure. The issue is due to improper checking of the status argument during validation failures.
Vulnerability Detail
The memory leak vulnerability in Tensorflow-gpu can be exploited by passing a list of strings to dlpack.to_dlpack function. If a validation failure occurs, the memory is not properly released, leading to a memory leak. This can result in excessive memory consumption and potential denial of service. The vulnerability is patched in commit 22e07fb204386768e5bcbea563641ea11f96ceb8 and is released in Tensorflow versions 2.2.1 and 2.3.1.
How To Fix
Latest published version: 2.12.0 as of 22 Oct 2026
pip install --upgrade "tensorflow-gpu==2.12.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.2.12.2.1pip install --upgrade "tensorflow-gpu==2.2.1" -
>= 2.3.0rc0, < 2.3.12.3.1pip install --upgrade "tensorflow-gpu==2.3.1"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update to the patched versions of Tensorflow-gpu.
Conclusion
The memory leak vulnerability in Tensorflow-gpu can be fixed by updating to versions 2.2.1 or 2.3.1. It is recommended to update the package to ensure the security and stability of your application. If you need further assistance or support in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for tensorflow-gpu →
FAQ
Tensorflow-gpu is a Python library for numerical computation and machine learning.
The vulnerability can result in a memory leak, leading to excessive memory consumption and potential denial of service.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. No signup is required, and you can simply enter your Pipfile.lock to get real-time alerts.
There is no known workaround for this vulnerability. It is recommended to update to the patched versions of Tensorflow-gpu.
You can find more information about this vulnerability in the Tensorflow-gpu advisory database at https://github.com/pypa/advisory-database/blob/main/vulns/tensorflow-gpu/PYSEC-2020-307.yaml
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow-gpu.
