PyPI/tensorflow-cpu CVE-2021-37654: high 7.3, EPSS 0.17%

Heap OOB and CHECK fail in `ResourceGather`

Action: Upgrade tensorflow-cpu to 2.3.4 or later.

pip install tensorflow-cpu==2.3.4

pip install tensorflow-cpu==2.4.3

pip install tensorflow-cpu==2.5.1

Affected

Fixed versions

Sources

• osv: GHSA-2r8p-fg3c-wcj4#PyPI/tensorflow-cpu
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-2r8p-fg3c-wcj4
• https://nvd.nist.gov/vuln/detail/CVE-2021-37654
• https://github.com/tensorflow/tensorflow/commit/bc9c546ce7015c57c2f15c168b3d9201de679a1d
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-567.yaml
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-765.yaml
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-276.yaml
• https://github.com/tensorflow/tensorflow

CVE-2021-37654 · published 2021-08-25T14:43:01Z · modified 2026-07-08T06:28:34.598348610Z · JSON