CVE-2022-29206

5.5 mediumEPSS 0.4%

Medium (5.5) in google tensorflow. EPSS 0.4% chance of exploitation in the next 30 days. Fixed in tensorflow 2.6.4, 2.7.2, 2.8.1.

TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.SparseTensorDenseAdd` does not fully validate the input arguments. In this case, a reference gets bound to a `nullptr` during kernel execution. This is undefined behavior. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.

Severity

CVSS 3.1

5.5 medium

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 30% of CVEs (scores of 2026-10-31)
CWEs: CWE-20, CWE-476
Published: 2022-05-20
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

google:tensorflow

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-rc9w-5c64-9vqq	PyPI	tensorflow	<2.6.4	2.6.4
GHSA-rc9w-5c64-9vqq	PyPI	tensorflow	>=2.7.0 <2.7.2	2.7.2
GHSA-rc9w-5c64-9vqq	PyPI	tensorflow	>=2.8.0 <2.8.1	2.8.1
GHSA-rc9w-5c64-9vqq	PyPI	tensorflow-cpu	<2.6.4	2.6.4
GHSA-rc9w-5c64-9vqq	PyPI	tensorflow-cpu	>=2.7.0 <2.7.2	2.7.2
GHSA-rc9w-5c64-9vqq	PyPI	tensorflow-cpu	>=2.8.0 <2.8.1	2.8.1
GHSA-rc9w-5c64-9vqq	PyPI	tensorflow-gpu	<2.6.4	2.6.4
GHSA-rc9w-5c64-9vqq	PyPI	tensorflow-gpu	>=2.7.0 <2.7.2	2.7.2
GHSA-rc9w-5c64-9vqq	PyPI	tensorflow-gpu	>=2.8.0 <2.8.1	2.8.1
PYSEC-2026-1032	PyPI	tensorflow-gpu	<2.6.4 >=2.7.0 <2.7.2 >=2.8.0 <2.8.1	2.6.4, 2.7.2, 2.8.1
PYSEC-2026-3235	PyPI	tensorflow	<2.6.4 >=2.7.0 <2.7.2 >=2.8.0 <2.8.1	2.6.4, 2.7.2, 2.8.1
PYSEC-2026-3365	PyPI	tensorflow-cpu	<2.6.4 >=2.7.0 <2.7.2 >=2.8.0 <2.8.1	2.6.4, 2.7.2, 2.8.1

References

Check your stack JSON