https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T10:43:28.671062+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-tensorflow-2021-41206 BIT-tensorflow-2021-41206 — Incomplete validation of shapes in multiple TF ops 2026-10-06T10:43:29.137794+00:00

Affected: Bitnami: tensorflow

TensorFlow is an open source platform for machine learning. In affected versions several TensorFlow operations are missing validation for the shapes of the tensor arguments involved in the call. Depending on the API, this can result in undefined behavior and segfault or `CHECK`-fail related crashes but in some scenarios writes and reads from heap populated arrays are also possible. We have discovered these issues internally via tooling while working on improving/testing GPU op determinism. As such, we don't have reproducers and there will be multiple fixes for these issues. These fixes will be included in TensorFlow 2.7.0. We will also cherrypick these commits on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

 https://cve.radiocsirt.org/vuln/euvd-2026-31623 EUVD-2026-31623 2026-10-06T10:43:29.137857+00:00 EUVD-2026-31623 https://cve.radiocsirt.org/vuln/fkie_cve-2021-41206 fkie_cve-2021-41206 2026-10-06T10:43:29.137874+00:00

TensorFlow is an open source platform for machine learning. In affected versions several TensorFlow operations are missing validation for the shapes of the tensor arguments involved in the call. Depending on the API, this can result in undefined behavior and segfault or `CHECK`-fail related crashes but in some scenarios writes and reads from heap populated arrays are also possible. We have discovered these issues internally via tooling while working on improving/testing GPU op determinism. As such, we don't have reproducers and there will be multiple fixes for these issues. These fixes will be included in TensorFlow 2.7.0. We will also cherrypick these commits on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

 https://cve.radiocsirt.org/vuln/ghsa-pgcq-h79j-2f69 GHSA-pgcq-h79j-2f69 — Incomplete validation of shapes in multiple TF ops 2026-10-06T10:43:29.137903+00:00

Affected: PyPI: tensorflow, PyPI: tensorflow-cpu, PyPI: tensorflow-gpu

### Impact Several TensorFlow operations are missing validation for the shapes of the tensor arguments involved in the call. Depending on the API, this can result in undefined behavior and segfault or `CHECK`-fail related crashes but in some scenarios writes and reads from heap populated arrays are also possible.

We have discovered these issues internally via tooling while working on improving/testing GPU op determinism. As such, we don't have reproducers and there will be multiple fixes for these issues.

### Patches We have patched the issue in GitHub commits [68422b215e618df5ad375bcdc6d2052e9fd3080a](https://github.com/tensorflow/tensorflow/commit/68422b215e618df5ad375bcdc6d2052e9fd3080a), [4d74d8a00b07441cba090a02e0dd9ed385145bf4](https://github.com/tensorflow/tensorflow/commit/4d74d8a00b07441cba090a02e0dd9ed385145bf4), [579261dcd446385831fe4f7457d802a59685121d](https://github.com/tensorflow/tensorflow/commit/579261dcd446385831fe4f7457d802a59685121d), [da4aad5946be30e5f049920fa076e1f7ef021261](https://github.com/tensorflow/tensorflow/commit/da4aad5946be30e5f049920fa076e1f7ef021261), [4dddb2fd0b01cdd196101afbba6518658a2c9e07](https://github.com/tensorflow/tensorflow/commit/4dddb2fd0b01cdd196101afbba6518658a2c9e07), and [e7f497570abb6b4ae5af4970620cd880e4c0c904](https://github.com/tensorflow/tensorflow/commit/e7f497570abb6b4ae5af4970620cd880e4c0c904).

These fixes will be included in TensorFlow 2.7.0. We will also cherrypick these commits on TensorFlow 2.6.1, TensorFlow 2…

 https://cve.radiocsirt.org/vuln/gsd-2021-41206 gsd-2021-41206 2026-10-06T10:43:29.137953+00:00 gsd-2021-41206 https://cve.radiocsirt.org/vuln/opensuse-su-2024:12116-1 openSUSE-SU-2024:12116-1 — tensorflow-lite-2.9.1-1.1 on GA media 2026-10-06T10:43:29.137966+00:00

tensorflow-lite-2.9.1-1.1 on GA media

 https://cve.radiocsirt.org/vuln/pysec-2021-843 PYSEC-2021-843 2026-10-06T10:43:29.138126+00:00

Affected: PyPI: tensorflow

TensorFlow is an open source platform for machine learning. In affected versions several TensorFlow operations are missing validation for the shapes of the tensor arguments involved in the call. Depending on the API, this can result in undefined behavior and segfault or `CHECK`-fail related crashes but in some scenarios writes and reads from heap populated arrays are also possible. We have discovered these issues internally via tooling while working on improving/testing GPU op determinism. As such, we don't have reproducers and there will be multiple fixes for these issues. These fixes will be included in TensorFlow 2.7.0. We will also cherrypick these commits on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.