CVE-2020-26269: Out-of-bounds Access Vulnerability in tensorflow-gpu
Summary
CVE-2020-26269: In TensorFlow release candidate versions 2.4.0rc*, the general implementation for matching filesystem paths to globbing pattern is vulnerable to an access out of bounds of the array holding the directories. Affects tensorflow-gpu across 2 version ranges.
>= 2.4.0rc0, < 2.4.0
< 8b5b9dc96666a3a5d27fad7179ff215e3b74b67c
Fixed in 8b5b9dc96666a3a5d27fad7179ff215e3b74b67c. How to fix ↓
Also tracked for
- tensorflow · Bitnami
- tensorflow · PyPI
- tensorflow · PyPI
- tensorflow-cpu · PyPI
The same CVE-2020-26269 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open-source machine learning framework widely used for developing and training machine learning models. The tensorflow-gpu package is a variant of TensorFlow that utilizes GPU acceleration for faster computation. It provides support for running TensorFlow on systems with compatible GPUs. This vulnerability affects the tensorflow-gpu package in release candidate versions 2.4.0rc*.
Vulnerability Detail
The vulnerability in tensorflow-gpu arises from a general implementation flaw in matching filesystem paths to globbing patterns. Specifically, the parallel implementation of GetMatchingPaths in the affected versions does not verify certain invariants and preconditions, leading to an access out of bounds of the array holding the directories. This vulnerability can be exploited by an attacker to perform unauthorized access or cause a denial-of-service condition. The issue has been patched in version 2.4.0 of TensorFlow. It is important to note that this vulnerability only impacts the master branch and the release candidates for TF version 2.4.
How To Fix
Latest published version: 2.12.0 as of 22 Oct 2026
pip install --upgrade "tensorflow-gpu==2.12.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
8b5b9dc96666a3a5d27fad7179ff215e3b74b67c
This is the first release that contains the fix.
pip install --upgrade "tensorflow-gpu==8b5b9dc96666a3a5d27fad7179ff215e3b74b67c"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability.
Conclusion
In conclusion, the tensorflow-gpu package in release candidate versions 2.4.0rc* is vulnerable to an out-of-bounds access issue. It is crucial to update to version 2.4.0 or later to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for tensorflow-gpu →
FAQ
TensorFlow is an open-source machine learning framework used for developing and training machine learning models.
The tensorflow-gpu package is a variant of TensorFlow that utilizes GPU acceleration for faster computation.
The vulnerability affects release candidate versions 2.4.0rc* of tensorflow-gpu.
This vulnerability can be exploited to perform unauthorized access or cause a denial-of-service condition.
To fix this vulnerability, update the tensorflow-gpu package to version 2.4.0 or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow-gpu.
