CVE-2021-41222

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

TensorFlow is an open source platform for machine learning. In affected versions the implementation of `SplitV` can trigger a segfault is an attacker supplies negative arguments. This occurs whenever `size_splits` contains more than one value and at least one value is negative. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-682

Affected software

No affected versions have been published.

Timeline

Published
Nov 5, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-412237.1TensorFlow is an open source platform for machine learning. In affected versions the implementation of `FusedBatchNorm` kernels is vulnerablCVE-2021-412247.1TensorFlow is an open source platform for machine learning. In affected versions the implementation of `SparseFillEmptyRows` can be made to CVE-2021-412257.8TensorFlow is an open source platform for machine learning. In affected versions TensorFlow's Grappler optimizer has a use of unitialized vaCVE-2021-412267.1TensorFlow is an open source platform for machine learning. In affected versions the implementation of `SparseBinCount` is vulnerable to a hCVE-2021-412275.5TensorFlow is an open source platform for machine learning. In affected versions the `ImmutableConst` operation in TensorFlow can be trickedCVE-2021-412287.8TensorFlow is an open source platform for machine learning. In affected versions TensorFlow's `saved_model_cli` tool is vulnerable to a codeCVE-2021-412296.5BlueZ is a Bluetooth protocol stack for Linux. In affected versions a vulnerability exists in sdp_cstate_alloc_buf which allocates memory whCVE-2021-41236.5livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)CVE-2021-412308.8Pomerium is an open source identity-aware access proxy. In affected versions changes to the OIDC claims of a user after initial login are noCVE-2021-412317.2OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, an administrator with the permissions to upload files via DatCVE-2021-412329.8Thunderdome is an open source agile planning poker tool in the theme of Battling for points. In affected versions there is an LDAP injectionCVE-2021-412335.3Nextcloud text is a collaborative document editing using Markdown built for the nextcloud server. Due to an issue with the Nextcloud Text ap
CVE-2021-41222: Medium severity, CVSS 5.5 | Vulnix