Back to Database
Status published
Medium
CVE-2022-23580
Abort caused by allocating a vector that is too large in Tensorflow
Vulnerability Description
Tensorflow is an Open Source Machine Learning Framework. During shape inference, TensorFlow can allocate a large vector based on a value from a tensor controlled by the user. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-23580
Credits & Attribution
No credits recorded in the NVD database.
References
- https://github.com/tensorflow/tensorflow/security/advisories/GHSA-627q-g293-49q7
- https://github.com/tensorflow/tensorflow/commit/1361fb7e29449629e1df94d44e0427ebec8c83c7
- https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/framework/shape_inference.cc#L788-L790
More from tensorflow
View All →CVE-2024-3660
Arbitrary code injection vulnerability in Keras framework < 2.13
Unknown
0
CVE-2023-33976
TensorFlow segfault in array_ops.upper_bound
High
7.5
CVE-2023-27579
TensorFlow has Floating Point Exception in TFLite in conv kernel
High
7.5
CVE-2023-25801
TensorFlow has double free in Fractional(Max/Avg)Pool
High
8
CVE-2023-25676
TensorFlow has null dereference on ParallelConcat with XLA
High
7.5
Affected Vendor
tensorflow
View all reports →Affected Software
tensorflow
Vulnerable Versions:
>= 2.7.0, < 2.7.1, >= 2.6.0, < 2.6.3, < 2.5.3
Timeline
Official Publish:
February 4th, 2022
Last Modified:
April 22nd, 2025
Added to House:
July 21st, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H