CVE-2020-15197
Denial of Service in Tensorflow
In Tensorflow before version 2.3.1, the SparseCountSparseOutput implementation does not validate that the input arguments form a valid sparse tensor. In particular, there is no validation that the indices tensor has rank 2. This tensor must be a matrix because code assumes its elements are accessed as elements of a matrix. However, malicious users can pass in tensors of different rank, resulting in a CHECK assertion failure and a crash. This can be used to cause denial of service in serving installations, if users are allowed to control the components of the input sparse tensor. The issue is patched in commit 3cbb917b4714766030b28eba9fb41bb97ce9ee02 and is released in TensorFlow version 2.3.1.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Denial of Service in Tensorflow
In Tensorflow before version 2.3.1, the SparseCountSparseOutput implementation does not validate that the input arguments form a valid sparse tensor. In particular, there is no validation that the indices tensor has rank 2. This tensor must be a matrix because code assumes its elements are accessed as elements of a matrix. However, malicious users can pass in tensors of different rank, resulting in a CHECK assertion failure and a crash. This can be used to cause denial of service in serving installations, if users are allowed to control the components of the input sparse tensor. The issue is patched in commit 3cbb917b4714766030b28eba9fb41bb97ce9ee02 and is released in TensorFlow version 2.3.1.
- Record
CVE-2020-15197- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H - Weakness
- CWE-617, CWE-20
- Updated
- 2026-11-02
EUVDEUVD-2020-0193
In Tensorflow before version 2.3.1, the SparseCountSparseOutput implementation does not validate that the input arguments form a valid sparse tensor. In particular, there is no validation that the indices tensor has rank 2. This tensor must be a matrix because code assumes its elements are accessed as elements of a matrix. However, malicious users can pass in tensors of different rank, resulting in a CHECK assertion failure and a crash. This can be used to cause denial of service in serving installations, if users are allowed to control the components of the input sparse tensor. The issue is patched in commit 3cbb917b4714766030b28eba9fb41bb97ce9ee02 and is released in TensorFlow version 2.3.1.
- Record
EUVD-2020-0193- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qc53-44cj-vfvx
Denial of Service in Tensorflow
Impact
The SparseCountSparseOutput implementation does not validate that the input arguments form a valid sparse tensor. In particular, there is no validation that the indices tensor has rank 2. This tensor must be a matrix because code assumes its elements are accessed as elements of a matrix:
https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/core/kernels/count_ops.cc#L185
However, malicious users can pass in tensors of different rank, resulting in a CHECK assertion failure and a crash. This can be used to cause denial of service in serving installations, if users are allowed to control the components of the input sparse tensor.
Patches
We have patched the issue in 3cbb917b4714766030b28eba9fb41bb97ce9ee02 and will release a patch release.
We recommend users to upgrade to TensorFlow 2.3.1.
For more information
Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution
This vulnerability is a variant of GHSA-p5f8-gfw5-33w4
- Record
GHSA-qc53-44cj-vfvx- CVSS 4.0
- 4.9 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H - CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H - Weakness
- CWE-20, CWE-617
- Updated
- 2026-11-02
NVD
In Tensorflow before version 2.3.1, the SparseCountSparseOutput implementation does not validate that the input arguments form a valid sparse tensor. In particular, there is no validation that the indices tensor has rank 2. This tensor must be a matrix because code assumes its elements are accessed as elements of a matrix. However, malicious users can pass in tensors of different rank, resulting in a CHECK assertion failure and a crash. This can be used to cause denial of service in serving installations, if users are allowed to control the components of the input sparse tensor. The issue is patched in commit 3cbb917b4714766030b28eba9fb41bb97ce9ee02 and is released in TensorFlow version 2.3.1.
- Record
CVE-2020-15197- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H - CVSS 2.0
- 3.5 Low
AV:N/AC:M/Au:S/C:N/I:N/A:P - Weakness
- CWE-20, CWE-617
- Updated
- 2026-11-02
OSV
In Tensorflow before version 2.3.1, the SparseCountSparseOutput implementation does not validate that the input arguments form a valid sparse tensor. In particular, there is no validation that the indices tensor has rank 2. This tensor must be a matrix because code assumes its elements are accessed as elements of a matrix. However, malicious users can pass in tensors of different rank, resulting in a CHECK assertion failure and a crash. This can be used to cause denial of service in serving installations, if users are allowed to control the components of the input sparse tensor. The issue is patched in commit 3cbb917b4714766030b28eba9fb41bb97ce9ee02 and is released in TensorFlow version 2.3.1.
- Record
CVE-2020-15197- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-qc53-44cj-vfvx
Denial of Service in Tensorflow
Impact
The SparseCountSparseOutput implementation does not validate that the input arguments form a valid sparse tensor. In particular, there is no validation that the indices tensor has rank 2. This tensor must be a matrix because code assumes its elements are accessed as elements of a matrix:
https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/core/kernels/count_ops.cc#L185
However, malicious users can pass in tensors of different rank, resulting in a CHECK assertion failure and a crash. This can be used to cause denial of service in serving installations, if users are allowed to control the components of the input sparse tensor.
Patches
We have patched the issue in 3cbb917b4714766030b28eba9fb41bb97ce9ee02 and will release a patch release.
We recommend users to upgrade to TensorFlow 2.3.1.
For more information
Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution
This vulnerability is a variant of GHSA-p5f8-gfw5-33w4
- Record
GHSA-qc53-44cj-vfvx- CVSS 4.0
- 4.9 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H - CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H - Weakness
- CWE-20, CWE-617
- Updated
- 2026-11-02
Show 4 moreShow less
OSVBIT-tensorflow-2020-15197 No score
Denial of Service in Tensorflow
In Tensorflow before version 2.3.1, the SparseCountSparseOutput implementation does not validate that the input arguments form a valid sparse tensor. In particular, there is no validation that the indices tensor has rank 2. This tensor must be a matrix because code assumes its elements are accessed as elements of a matrix. However, malicious users can pass in tensors of different rank, resulting in a CHECK assertion failure and a crash. This can be used to cause denial of service in serving installations, if users are allowed to control the components of the input sparse tensor. The issue is patched in commit 3cbb917b4714766030b28eba9fb41bb97ce9ee02 and is released in TensorFlow version 2.3.1.
- Record
BIT-tensorflow-2020-15197- Updated
- 2026-11-02
OSVPYSEC-2020-120 No score
In Tensorflow before version 2.3.1, the SparseCountSparseOutput implementation does not validate that the input arguments form a valid sparse tensor. In particular, there is no validation that the indices tensor has rank 2. This tensor must be a matrix because code assumes its elements are accessed as elements of a matrix. However, malicious users can pass in tensors of different rank, resulting in a CHECK assertion failure and a crash. This can be used to cause denial of service in serving installations, if users are allowed to control the components of the input sparse tensor. The issue is patched in commit 3cbb917b4714766030b28eba9fb41bb97ce9ee02 and is released in TensorFlow version 2.3.1.
- Record
PYSEC-2020-120- Updated
- 2026-11-02
OSVPYSEC-2020-277 No score
In Tensorflow before version 2.3.1, the SparseCountSparseOutput implementation does not validate that the input arguments form a valid sparse tensor. In particular, there is no validation that the indices tensor has rank 2. This tensor must be a matrix because code assumes its elements are accessed as elements of a matrix. However, malicious users can pass in tensors of different rank, resulting in a CHECK assertion failure and a crash. This can be used to cause denial of service in serving installations, if users are allowed to control the components of the input sparse tensor. The issue is patched in commit 3cbb917b4714766030b28eba9fb41bb97ce9ee02 and is released in TensorFlow version 2.3.1.
- Record
PYSEC-2020-277- Updated
- 2026-11-02
OSVPYSEC-2020-312 No score
In Tensorflow before version 2.3.1, the SparseCountSparseOutput implementation does not validate that the input arguments form a valid sparse tensor. In particular, there is no validation that the indices tensor has rank 2. This tensor must be a matrix because code assumes its elements are accessed as elements of a matrix. However, malicious users can pass in tensors of different rank, resulting in a CHECK assertion failure and a crash. This can be used to cause denial of service in serving installations, if users are allowed to control the components of the input sparse tensor. The issue is patched in commit 3cbb917b4714766030b28eba9fb41bb97ce9ee02 and is released in TensorFlow version 2.3.1.
- Record
PYSEC-2020-312- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
tensorflowPyPI |
2.3.0 to 2.3.0 | 2.3.1 |
tensorflow-cpuPyPI |
2.3.0 to 2.3.0 | 2.3.1 |
tensorflow-gpuPyPI |
2.3.0 to 2.3.0 | 2.3.1 |
tensorflowBitnami |
2.3.0 up to 2.3.1 | 2.3.1 |
tensorflowPyPI |
2.3.0 up to 2.3.1 | 2.3.1 |
tensorflow-cpuPyPI |
2.3.0 up to 2.3.1 | 2.3.1 |
tensorflow-gpuPyPI |
2.3.0 up to 2.3.1 | 2.3.1 |
tensorflowPyPI |
before 2.3.1, plus listed versions 0.12.0rc00.12.0rc10.12.00.12.11.0.0 Show 45 moreShow less1.0.11.1.0rc01.1.0rc11.1.0rc21.1.01.2.0rc01.2.0rc11.2.0rc21.2.01.2.11.3.0rc01.3.0rc11.3.0rc21.3.01.4.0rc01.4.0rc11.4.01.4.11.5.0rc01.5.0rc11.5.01.5.11.6.0rc01.6.0rc11.6.01.7.0rc01.7.0rc11.7.01.7.11.8.0rc01.8.0rc11.8.01.9.0rc01.9.0rc11.9.0rc21.9.01.10.0rc01.10.0rc11.10.01.10.11.11.0rc01.11.0rc11.11.0rc21.11.01.12.0rc0 |
2.3.1 |
tensorflow-cpuPyPI |
before 2.3.1, plus listed versions 1.15.02.1.02.1.12.1.22.1.3 Show 6 moreShow less2.1.42.2.02.2.12.2.22.2.32.3.0 |
2.3.1 |
tensorflow-gpuPyPI |
before 2.3.1, plus listed versions 0.12.00.12.11.0.01.0.11.1.0 Show 41 moreShow less1.10.01.10.11.11.01.12.01.12.21.12.31.13.11.13.21.14.01.15.01.15.21.15.31.15.41.15.51.2.01.2.11.3.01.4.01.4.11.5.01.5.11.6.01.7.01.7.11.8.01.9.02.0.02.0.12.0.22.0.32.0.42.1.02.1.12.1.22.1.32.1.42.2.02.2.12.2.22.2.32.3.0 |
2.3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-15197 is a medium vulnerability (CVSS 6.3) in Google Tensorflow, published September 25, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.73%, the 54th percentile. Fixed in tensorflow 2.3.1.
References
github.com/tensorflow/tensorflow/releases/tag/v2.3.1
nvd.nist.gov/vuln/detail/CVE-2020-15197
Left out here: 54 versions. The JSON record has them.