PyPI: tensorflow-macos

CVE-2021-41195

Safety vulnerability ID: SFTY-20211105-75362

Safety legacy ID: pyup.io-58448

Tensorflow-macos versions 2.4.4, 2.5.2 and 2.6.1 include a fix for CVE-2021-41195: In affected versions, the implementation of 'tf.math.segment_*' operations results in a 'CHECK'-fail related abort (and denial of service) if a segment id in 'segment_ids' is large. This is similar to CVE-2021-29584 (and similar to other reported vulnerabilities in TensorFlow localized to specific APIs): the implementation (both on CPU and GPU) computes the output shape using 'AddDim'. However, if the number of elements in the tensor overflows an 'int64_t' value, 'AddDim' results in a 'CHECK' failure which provokes a 'std::abort'. Instead, code should use 'AddDimWithStatus'. The fix is included in TensorFlow 2.7.0. https://github.com/tensorflow/tensorflow/security/advisories/GHSA-cq76-mxrc-vchh

PythonPyPINVDNVDGitHubGHSA
Created at: Jul 5, 2026Updated at: Jul 5, 2026

Overview

Crash in `tf.math.segment_*` operations

Advisory

Tensorflow-macos versions 2.4.4, 2.5.2 and 2.6.1 include a fix for CVE-2021-41195: In affected versions, the implementation of 'tf.math.segment_*' operations results in a 'CHECK'-fail related abort (and denial of service) if a segment id in 'segment_ids' is large. This is similar to CVE-2021-29584 (and similar to other reported vulnerabilities in TensorFlow localized to specific APIs): the implementation (both on CPU and GPU) computes the output shape using 'AddDim'. However, if the number of elements in the tensor overflows an 'int64_t' value, 'AddDim' results in a 'CHECK' failure which provokes a 'std::abort'. Instead, code should use 'AddDimWithStatus'. The fix is included in TensorFlow 2.7.0. https://github.com/tensorflow/tensorflow/security/advisories/GHSA-cq76-mxrc-vchh

Affected Package

Affecting tensorflow-macos package, versions<2.4.4>=2.5.0rc0,<2.5.2>=2.6.0rc0,<2.6.1

Also affects

---

How to Fix

Upgradetensorflow-macosto2.7.02.7.02.7.0or higher.

Mitigation and Workarounds

---

Vulnerable Functions

Functions linked to known vulnerabilities.

Vulnerable function data is available for Enterprise customers

Book a call with us to see Safety in action.

References

Safety

Verified by Safety

Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.

Learn more