CVE-2021-41198: TensorFlow GPU - Integer Overflow in tf.tile
Summary
CVE-2021-41198: TensorFlow is an open source platform for machine learning. Affects tensorflow-gpu across 5 version ranges.
< 2.4.4
>= 2.5.0, < 2.5.2
>= 2.6.0, < 2.6.1
>= 2.7.0rc0, < 2.7.0
< 9294094df6fea79271778eb7e7ae1bad8b5ef98f
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- tensorflow · Bitnami
- tensorflow · PyPI
- tensorflow · PyPI
- tensorflow-cpu · PyPI
The same CVE-2021-41198 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open-source platform for machine learning. It provides a comprehensive ecosystem of tools, libraries, and resources for developing and deploying machine learning models. TensorFlow GPU is a specific package that enables GPU acceleration for TensorFlow. It allows users to leverage the power of GPUs to accelerate their machine learning computations, resulting in faster training and inference times.
Vulnerability Detail
The vulnerability identified as CVE-2021-41198 affects TensorFlow GPU versions prior to 2.7.0. When the tf.tile function is called with a large input argument, an integer overflow occurs. This overflow causes a CHECK-failure, leading to a process crash. The issue arises because the number of elements in the output tensor exceeds the capacity of the int64_t type, triggering the overflow. As a result, the TensorFlow process aborts. This vulnerability can be exploited by an attacker to disrupt TensorFlow-based machine learning systems or cause denial-of-service (DoS) conditions.
How To Fix
Latest published version: 2.12.0 as of 22 Oct 2026
pip install --upgrade "tensorflow-gpu==2.12.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.4.42.4.4pip install --upgrade "tensorflow-gpu==2.4.4" -
>= 2.5.0, < 2.5.22.5.2pip install --upgrade "tensorflow-gpu==2.5.2" -
>= 2.6.0, < 2.6.12.6.1pip install --upgrade "tensorflow-gpu==2.6.1" -
>= 2.7.0rc0, < 2.7.02.7.0pip install --upgrade "tensorflow-gpu==2.7.0"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update TensorFlow GPU to the fixed versions mentioned above.
Conclusion
The vulnerability identified as CVE-2021-41198 in TensorFlow GPU can result in a process crash when the tf.tile function is called with a large input argument. This can be exploited by attackers to disrupt machine learning systems or cause denial-of-service conditions. To mitigate this risk, it is recommended to update TensorFlow GPU to version 2.7.0 or one of the backported fixes. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow-gpu →
FAQ
TensorFlow GPU is a package that enables GPU acceleration for TensorFlow, allowing users to leverage the power of GPUs for faster machine learning computations.
The vulnerability can lead to a process crash in TensorFlow GPU when the tf.tile function is called with a large input argument. This can be exploited by an attacker to disrupt machine learning systems or cause denial-of-service (DoS) conditions.
The vulnerability affects TensorFlow GPU versions prior to 2.7.0. Specifically, versions 2.4.4, 2.5.2, and 2.6.1 are also affected.
To fix this vulnerability, update TensorFlow GPU to version 2.7.0 or later. Alternatively, you can upgrade to one of the backported fixes: TensorFlow 2.6.1, TensorFlow 2.5.2, or TensorFlow 2.4.4.
No, there is no known workaround for this vulnerability. It is crucial to update TensorFlow GPU to the fixed versions.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow-gpu.
