VYPR
Moderate severityNVD Advisory· Published May 20, 2022· Updated Apr 22, 2025

Denial of service in TensorFlow due to lack of validation in `tf.ragged.constant`

CVE-2022-29202

Description

TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of tf.ragged.constant does not fully validate the input arguments. This results in a denial of service by consuming all available memory. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
tensorflowPyPI
< 2.6.42.6.4
tensorflowPyPI
>= 2.7.0, < 2.7.22.7.2
tensorflowPyPI
>= 2.8.0, < 2.8.12.8.1
tensorflow-cpuPyPI
< 2.6.42.6.4
tensorflow-cpuPyPI
>= 2.7.0, < 2.7.22.7.2
tensorflow-cpuPyPI
>= 2.8.0, < 2.8.12.8.1
tensorflow-gpuPyPI
< 2.6.42.6.4
tensorflow-gpuPyPI
>= 2.7.0, < 2.7.22.7.2
tensorflow-gpuPyPI
>= 2.8.0, < 2.8.12.8.1

Affected products

1

Patches

1
bd4d5583ff9c

Prevent denial of service in `tf.ragged.constant`

https://github.com/tensorflow/tensorflowMihai MaruseacApr 15, 2022via ghsa
1 file changed · +3 0
  • tensorflow/python/ops/ragged/ragged_factory_ops.py+3 0 modified
    @@ -188,6 +188,9 @@ def _constant_value(ragged_factory, inner_factory, pylist, dtype, ragged_rank,
         if max_depth > scalar_depth:
           raise ValueError("Invalid pylist=%r: empty list nesting is greater "
                            "than scalar value nesting" % pylist)
    +    if ragged_rank is not None and max_depth < ragged_rank:
    +      raise ValueError(f"Invalid pylist={pylist}, max depth smaller than "
    +                       f"ragged_rank={ragged_rank}")
     
       # If both inner_shape and ragged_rank were specified, then check that
       # they are compatible with pylist.
    

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

10

News mentions

0

No linked articles in our index yet.