CVE-2021-37686: TensorFlow GPU - Infinite Loop in TFLite Strided Slice Implementation
Summary
CVE-2021-37686: TensorFlow is an end-to-end open source platform for machine learning. Affects tensorflow-gpu across 3 version ranges.
>= 2.3.0, < 2.3.4
>= 2.4.0, < 2.4.3
< dfa22b348b70bb89d6d6ec0ff53973bacb4f4695
Fixed in 2.3.4 or 2.4.3, depending on the release line you run. How to fix ↓
Also tracked for
- tensorflow · Bitnami
- tensorflow · PyPI
- tensorflow · PyPI
- tensorflow-cpu · PyPI
The same CVE-2021-37686 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an end-to-end open source platform for machine learning. It provides a comprehensive ecosystem of tools, libraries, and resources for developing and deploying machine learning models. TensorFlow GPU is a variant of TensorFlow that leverages GPU acceleration for faster computation. It is widely used in various industries and research domains for deep learning tasks.
Vulnerability Detail
The vulnerability (CVE-2021-37686) exists in the strided slice implementation of TFLite, a component of TensorFlow GPU. The issue arises from a logic bug in the implementation that can be exploited by an attacker to trigger an infinite loop. This vulnerability is introduced due to the newly added support for ellipsis in axis definition. By crafting a malicious model, an attacker can manipulate the ellipsis_end_idx parameter to be smaller than i, causing the inner loop to not increase i and the continue statement to skip over the necessary increment at the end of the outer loop. This leads to an infinite loop, potentially resulting in denial of service or resource exhaustion. The vulnerability affects TensorFlow GPU version 2.6.0.
How To Fix
Latest published version: 2.12.0 as of 22 Oct 2026
pip install --upgrade "tensorflow-gpu==2.12.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.3.0, < 2.3.42.3.4pip install --upgrade "tensorflow-gpu==2.3.4" -
>= 2.4.0, < 2.4.32.4.3pip install --upgrade "tensorflow-gpu==2.4.3"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. Users are advised to update to the patched version as mentioned in the 'how_to_fix' section.
Conclusion
The vulnerability (CVE-2021-37686) in TensorFlow GPU's TFLite strided slice implementation can lead to an infinite loop when exploited. It is crucial for users to update their TensorFlow GPU installation to a patched version to mitigate the risk of denial of service or resource exhaustion. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for tensorflow-gpu →
FAQ
TensorFlow GPU is a variant of TensorFlow that utilizes GPU acceleration for faster computation in machine learning tasks.
TFLite is a component of TensorFlow GPU that provides a lightweight solution for deploying machine learning models on resource-constrained devices.
This vulnerability can be exploited by an attacker to trigger an infinite loop in the TFLite strided slice implementation, potentially leading to denial of service or resource exhaustion.
The vulnerability affects TensorFlow GPU version 2.6.0.
To fix this vulnerability, update your TensorFlow GPU installation to a version that includes the fix, such as 2.3.4 or 2.4.3.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow-gpu.
