CVE-2021-41209
FPE in convolutions with zero size filters
Reported by github_m · Published November 5, 2021
tensorflow-gpu is fixed in 2.6.1, 2.5.2 and 2.4.4 (PyPI)
TensorFlow is an open source platform for machine learning. In affected versions the implementations for convolution operators trigger a division by 0 if passed empty filter tensor arguments. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| tensorflow-gpu | PyPI | 2.6.1, 2.5.2, 2.4.4 |
| tensorflow-cpu | PyPI | f2c3931113eaafe9ef558faaddd48e00a6606235, 2.7.0, 2.6.1, 2.5.2, 2.4.4 |
| tensorflow | PyPI | 2.7.0, 2.6.1, 2.5.2, 2.4.4 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| tensorflow | tensorflow | >= 2.6.0, < 2.6.1, >= 2.5.0, < 2.5.2, < 2.4.4 |
| PyPI | tensorflow-gpu | 2.6.0, 0, 2.5.0 |
| PyPI | tensorflow | 0, 2.6.0, 2.5.0 |
| arch | tensorflow | 0 |
| tensorflow | tensorflow | 0, 2.5.0, 2.6.0 |
| PyPI | tensorflow-cpu | 0, 2.6.0, 2.5.0 |
Timeline
- Nov 5, 2021 CVE Published
- Nov 6, 2021 EPSS Score (30 in total, the first dated here)
- Nov 21, 2024 CVE Updated
- Mar 9, 2026 Security Advisory
- Jul 20, 2026 Coalition ESS Score
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2021-41209
vulnetix vdb fixes CVE-2021-41209Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2021-41209/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- x_refsource_CONFIRM
- x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2021-41209 advisory
- https://github.com/advisories/GHSA-6hpv-v2rx-c5g6 advisory
- https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-618.yaml advisory
- https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-816.yaml advisory
- https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-401.yaml advisory
- https://github.com/tensorflow/tensorflow url