CVE-2020-15213: Denial of Service Vulnerability in TensorFlow Lite
Summary
CVE-2020-15213: In TensorFlow Lite before versions 2.2.1 and 2.3.1, models using segment sum can trigger a denial of service by causing an out of memory allocation in the implementation of segment sum. Affects tensorflow-gpu across 3 version ranges.
>= 2.2.0, < 2.2.1
>= 2.3.0, < 2.3.1
< 204945b19e44b57906c9344c0d00120eeeae178a
Fixed in 2.2.1 or 2.3.1, depending on the release line you run. How to fix ↓
Also tracked for
- tensorflow · Bitnami
- tensorflow · PyPI
- tensorflow-cpu · PyPI
- tensorflow · PyPI
The same CVE-2020-15213 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow Lite is an open-source deep learning framework designed for mobile and embedded devices. It allows developers to deploy machine learning models on resource-constrained platforms. TensorFlow Lite includes various operations, such as segment sum, which can be used to perform computations on segmented tensors. However, a vulnerability has been discovered in TensorFlow Lite versions before 2.2.1 and 2.3.1 that can lead to a denial of service (DoS) attack.
Vulnerability Detail
The vulnerability in TensorFlow Lite arises from a flaw in the implementation of segment sum. When models using segment sum are executed, an out of memory allocation can occur due to the code using the last element of the tensor to determine the dimensionality of the output tensor. An attacker can exploit this by providing a very large value, triggering a large allocation and causing the system to run out of memory. This can result in a DoS condition, rendering the affected TensorFlow Lite instance unresponsive. The issue has been patched in commit 204945b19e44b57906c9344c0d00120eeeae178a and is included in TensorFlow versions 2.2.1 and 2.3.1.
How To Fix
Latest published version: 2.12.0 as of 22 Oct 2026
pip install --upgrade "tensorflow-gpu==2.12.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.2.0, < 2.2.12.2.1pip install --upgrade "tensorflow-gpu==2.2.1" -
>= 2.3.0, < 2.3.12.3.1pip install --upgrade "tensorflow-gpu==2.3.1"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
A potential workaround for this vulnerability is to add a custom Verifier to limit the maximum value in the segment ids tensor. This can be done if the segment ids are stored statically in the model. However, if the segment ids are generated dynamically during inference steps, there is no possible workaround. In such cases, it is advised to upgrade to the patched versions of TensorFlow Lite.
Conclusion
The vulnerability in TensorFlow Lite versions before 2.2.1 and 2.3.1 can lead to a denial of service (DoS) attack. Users are advised to upgrade to the patched versions (2.2.1 or 2.3.1) to mitigate this vulnerability. For further assistance on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow-gpu →
FAQ
TensorFlow Lite is an open-source deep learning framework designed for mobile and embedded devices. It allows developers to deploy machine learning models on resource-constrained platforms.
The vulnerability can be exploited to trigger a denial of service (DoS) condition in TensorFlow Lite instances, rendering them unresponsive.
Versions of TensorFlow Lite before 2.2.1 and 2.3.1 are affected by this vulnerability.
To fix this vulnerability, upgrade to the patched versions of TensorFlow Lite (2.2.1 or 2.3.1) by updating the TensorFlow Lite package in the Python package manager.
A workaround is available if the segment ids are stored statically in the model. It involves adding a custom Verifier to limit the maximum value in the segment ids tensor. However, if the segment ids are generated dynamically during inference steps, there is no possible workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow-gpu.
