https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-24T01:35:34.383635+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-tensorflow-2020-15266 BIT-tensorflow-2020-15266 — Undefined behavior in Tensorflow 2026-10-24T01:35:34.389045+00:00

Affected: Bitnami: tensorflow

In Tensorflow before version 2.4.0, when the `boxes` argument of `tf.image.crop_and_resize` has a very large value, the CPU kernel implementation receives it as a C++ `nan` floating point value. Attempting to operate on this is undefined behavior which later produces a segmentation fault. The issue is patched in eccb7ec454e6617738554a255d77f08e60ee0808 and TensorFlow 2.4.0 will be released containing the patch. TensorFlow nightly packages after this commit will also have the issue resolved.

 https://cve.radiocsirt.org/vuln/cnvd-2020-62809 cnvd-2020-62809 2026-10-24T01:35:34.389094+00:00 cnvd-2020-62809 https://cve.radiocsirt.org/vuln/euvd-2026-42796 EUVD-2026-42796 2026-10-24T01:35:34.389110+00:00 EUVD-2026-42796 https://cve.radiocsirt.org/vuln/fkie_cve-2020-15266 fkie_cve-2020-15266 2026-10-24T01:35:34.389122+00:00

In Tensorflow before version 2.4.0, when the `boxes` argument of `tf.image.crop_and_resize` has a very large value, the CPU kernel implementation receives it as a C++ `nan` floating point value. Attempting to operate on this is undefined behavior which later produces a segmentation fault. The issue is patched in eccb7ec454e6617738554a255d77f08e60ee0808 and TensorFlow 2.4.0 will be released containing the patch. TensorFlow nightly packages after this commit will also have the issue resolved.

 https://cve.radiocsirt.org/vuln/ghsa-xwhf-g6j5-j5gc GHSA-xwhf-g6j5-j5gc — Float cast overflow undefined behavior 2026-10-24T01:35:34.389143+00:00

Affected: PyPI: tensorflow, PyPI: tensorflow-cpu, PyPI: tensorflow-gpu

### Impact When the `boxes` argument of `tf.image.crop_and_resize` has a very large value, the CPU kernel implementation receives it as a C++ `nan` floating point value. Attempting to operate on this is undefined behavior which later produces a segmentation fault.

### Patches

We have patched the issue in c0319231333f0f16e1cc75ec83660b01fedd4182 and will release TensorFlow 2.4.0 containing the patch. TensorFlow nightly packages after this commit will also have the issue resolved.

### For more information Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution This vulnerability has been reported in #42129

 https://cve.radiocsirt.org/vuln/gsd-2020-15266 gsd-2020-15266 2026-10-24T01:35:34.389172+00:00 gsd-2020-15266 https://cve.radiocsirt.org/vuln/pysec-2020-139 PYSEC-2020-139 2026-10-24T01:35:34.389183+00:00

Affected: PyPI: tensorflow

In Tensorflow before version 2.4.0, when the `boxes` argument of `tf.image.crop_and_resize` has a very large value, the CPU kernel implementation receives it as a C++ `nan` floating point value. Attempting to operate on this is undefined behavior which later produces a segmentation fault. The issue is patched in eccb7ec454e6617738554a255d77f08e60ee0808 and TensorFlow 2.4.0 will be released containing the patch. TensorFlow nightly packages after this commit will also have the issue resolved.