PyPI: tensorflow-gpu

CVE-2022-21736

Safety vulnerability ID: SFTY-20220203-67251

Safety legacy ID: pyup.io-56039

Tensorflow-gpu versions 2.5.3, 2.6.3, 2.7.1 and 2.8.0 include a fix for CVE-2022-21736: The implementation of 'SparseTensorSliceDataset' has an undefined behavior: under certain conditions, it can be made to dereference a 'nullptr' value. The 3 input arguments to 'SparseTensorSliceDataset' represent a sparse tensor. However, there are some preconditions that these arguments must satisfy, but these are not validated in the implementation. https://github.com/tensorflow/tensorflow/security/advisories/GHSA-pfjj-m3jj-9jc9

PythonPyPINVDNVDGitHubGHSA
Created at: Jul 5, 2026Updated at: Jul 5, 2026

Overview

Undefined behavior in `SparseTensorSliceDataset`

Advisory

Tensorflow-gpu versions 2.5.3, 2.6.3, 2.7.1 and 2.8.0 include a fix for CVE-2022-21736: The implementation of 'SparseTensorSliceDataset' has an undefined behavior: under certain conditions, it can be made to dereference a 'nullptr' value. The 3 input arguments to 'SparseTensorSliceDataset' represent a sparse tensor. However, there are some preconditions that these arguments must satisfy, but these are not validated in the implementation. https://github.com/tensorflow/tensorflow/security/advisories/GHSA-pfjj-m3jj-9jc9

Affected Package

Affecting tensorflow-gpu package, versions<2.5.3>=2.6.0a0,<2.6.3>=2.7.0a0,<2.7.1>=2.8.0a0,<2.8.0

Also affects

---

How to Fix

Upgradetensorflow-gputo2.5.32.6.32.7.12.8.0or higher.

Mitigation and Workarounds

---

Vulnerable Functions

Functions linked to known vulnerabilities.

Vulnerable function data is available for Enterprise customers

Book a call with us to see Safety in action.

References

Safety

Verified by Safety

Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.

Learn more