CVE-2023-25665: TensorFlow SparseSparseMaximum Null Pointer Error Vulnerability
Summary
CVE-2023-25665: TensorFlow has Null Pointer Error in SparseSparseMaximum. Affects tensorflow-cpu versions < 2.11.1. Fixed in 2.11.1. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow-gpu · PyPI
- tensorflow · Bitnami
- tensorflow · PyPI
The same CVE-2023-25665 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open-source machine learning framework widely used for building and deploying machine learning models. It provides a comprehensive ecosystem for developing deep learning applications, including tools for data manipulation, model training, and deployment. The framework supports various operations, including sparse tensor operations, which are crucial for efficiently handling large datasets with many zero values. However, TensorFlow has a vulnerability in the SparseSparseMaximum operation that can lead to a null pointer error when invalid sparse tensors are provided as inputs.
Vulnerability Detail
The vulnerability arises in the SparseSparseMaximum operation of TensorFlow when it receives invalid sparse tensors as inputs. This can lead to a null pointer exception (NPE), causing the application to crash or behave unexpectedly. For instance, if a user attempts to execute the following code with invalid inputs, it will trigger the NPE: import tensorflow as tf; tf.raw_ops.SparseSparseMaximum(a_indices=[[1]], a_values=[0.1], a_shape=[2], b_indices=[[]], b_values=[2], b_shape=[2]). The ramifications of this vulnerability can be significant, especially in production environments where stability and reliability are critical.
How To Fix
Latest published version: 2.21.0 as of 22 Oct 2026
pip install --upgrade "tensorflow-cpu==2.21.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.11.1
This is the first release that contains the fix.
pip install --upgrade "tensorflow-cpu==2.11.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users should validate the inputs to the SparseSparseMaximum operation to ensure they are not invalid sparse tensors. This can prevent the null pointer exception from occurring. For example, check that the indices and values are correctly formatted and that the shapes of the tensors are appropriate before calling the operation.
Conclusion
In summary, TensorFlow has a vulnerability in the SparseSparseMaximum operation that can lead to a null pointer error when invalid sparse tensors are used. Users are advised to update to version 2.11.1 or later to mitigate this issue. Additionally, validating inputs can serve as a temporary workaround until the update can be applied.
See every vulnerability recorded for tensorflow-cpu →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
The vulnerability affects TensorFlow versions prior to 2.11.1.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring access to the code or installation.
If you cannot update TensorFlow immediately, ensure to validate the inputs to the SparseSparseMaximum operation to avoid triggering the null pointer exception.
This vulnerability was reported by Yu Tian of the Qihoo 360 AIVul Team.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow-cpu.
