CVE-2021-29519: TensorFlow GPU - Type Confusion Denial of Service
Summary
CVE-2021-29519: TensorFlow is an end-to-end open source platform for machine learning. Affects tensorflow-gpu across 5 version ranges.
< 2.1.4
>= 2.2.0, < 2.2.3
>= 2.3.0, < 2.3.3
>= 2.4.0, < 2.4.2
< b1cc5e5a50e7cee09f2c6eb48eb40ee9c4125025
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- tensorflow · Bitnami
- tensorflow · PyPI
- tensorflow · PyPI
- tensorflow-cpu · PyPI
The same CVE-2021-29519 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open-source platform for machine learning that provides a comprehensive set of tools and libraries for building and deploying machine learning models. It supports various hardware accelerators, including GPUs, to enhance performance. TensorFlow GPU (tensorflow-gpu) is a specific package that enables GPU support in TensorFlow. It allows users to leverage the power of GPUs for faster training and inference of machine learning models.
Vulnerability Detail
The vulnerability (CVE-2021-29519) affects the tf.raw_ops.SparseCross API in TensorFlow GPU. It arises due to a type confusion issue in the implementation of the API. The vulnerability can be triggered by combining certain input combinations, leading to a CHECK failure and denial of service. The root cause of the issue is the incorrect handling of a tensor of type tstring that actually contains integral elements. By exploiting this type confusion, an attacker can cause the TensorFlow application to crash, resulting in a denial of service. The vulnerability has the potential to impact the availability and reliability of TensorFlow GPU applications.
How To Fix
Latest published version: 2.12.0 as of 22 Oct 2026
pip install --upgrade "tensorflow-gpu==2.12.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.1.42.1.4pip install --upgrade "tensorflow-gpu==2.1.4" -
>= 2.2.0, < 2.2.32.2.3pip install --upgrade "tensorflow-gpu==2.2.3" -
>= 2.3.0, < 2.3.32.3.3pip install --upgrade "tensorflow-gpu==2.3.3" -
>= 2.4.0, < 2.4.22.4.2pip install --upgrade "tensorflow-gpu==2.4.2"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. Users are encouraged to apply the provided fix by updating to the patched versions of TensorFlow GPU.
Conclusion
The vulnerability (CVE-2021-29519) in TensorFlow GPU can lead to a denial of service by exploiting a type confusion issue in the tf.raw_ops.SparseCross API. It is crucial for users to update their TensorFlow GPU installations to the latest patched versions to mitigate the vulnerability. Failure to do so may result in application crashes and impact the availability and reliability of TensorFlow GPU applications. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow-gpu →
FAQ
TensorFlow GPU is a package that enables GPU support in TensorFlow, allowing users to leverage the power of GPUs for faster training and inference of machine learning models.
The vulnerability can result in a denial of service by causing a TensorFlow GPU application to crash. It affects the availability and reliability of TensorFlow GPU applications.
To fix the vulnerability, update your TensorFlow GPU installation to the latest patched version, which includes the fix for the type confusion issue.
Yes, the vulnerability affects multiple versions of TensorFlow GPU, including 2.1.4, 2.2.3, 2.3.3, 2.4.2, and versions prior to 2.5.0.
No specific workaround is mentioned for this vulnerability. It is recommended to update to the patched versions of TensorFlow GPU.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow-gpu.
