PYSEC-2026-3350: Missing validation causes denial of service in TensorFlow via `SparseTensorToCSRSparseMatrix`

Q: Which TensorFlow versions need remediation?

Versions earlier than 2.6.4, 2.7.2, 2.8.1, and 2.9.0 are affected in their respective release lines. Upgrade to one of those patched versions or a later version.

Q: What access does an attacker need to trigger the denial of service?

The vulnerability has local attack vector and low privileges required. An attacker must be able to invoke tf.raw_ops.SparseTensorToCSRSparseMatrix with malformed sparse-tensor inputs.

Q: What malformed inputs cause the failure?

The affected implementation fails to validate that dense_shape is a vector and indices is a matrix. Inputs that violate those expected shapes can cause a CHECK failure and deny service.

Published May 20, 2022

Updated

TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of tf.rawops.SparseTensorToCSRSparseMatrix does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack. The code assumes denseshape is a vector and indices is a matrix (as part of requirements for sparse tensors) but there is no validation for this. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.

Affected Software

1 affected component

Google TensorFlow<2.9.0, <2.8.1, <2.7.2, <2.6.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade TensorFlow to a version that resolves this vulnerability.
Fixed in 2.9.0
Upgrade
Upgrade TensorFlow to a version that resolves this vulnerability.
Fixed in 2.8.1
Upgrade
Upgrade TensorFlow to a version that resolves this vulnerability.
Fixed in 2.7.2
Upgrade
Upgrade TensorFlow to a version that resolves this vulnerability.
Fixed in 2.6.4

Event History

May 20, 2022

CVE Published

via OSV·09:50 PM

Data Sourced

via OSV·09:50 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which TensorFlow versions need remediation?

Versions earlier than 2.6.4, 2.7.2, 2.8.1, and 2.9.0 are affected in their respective release lines. Upgrade to one of those patched versions or a later version.

What access does an attacker need to trigger the denial of service?

The vulnerability has local attack vector and low privileges required. An attacker must be able to invoke tf.raw_ops.SparseTensorToCSRSparseMatrix with malformed sparse-tensor inputs.

What malformed inputs cause the failure?

The affected implementation fails to validate that dense_shape is a vector and indices is a matrix. Inputs that violate those expected shapes can cause a CHECK failure and deny service.

PYSEC-2026-3350: Missing validation causes denial of service in TensorFlow via `SparseTensorToCSRSparseMatrix`

Affected Software

Remediation

Event History

Frequently Asked Questions

Which TensorFlow versions need remediation?

What access does an attacker need to trigger the denial of service?

What malformed inputs cause the failure?

Company

Resources

Contact

Frequently Asked Questions

Which TensorFlow versions need remediation?

What access does an attacker need to trigger the denial of service?

What malformed inputs cause the failure?