Every CVE Search/ Get API key

CVE-2020-15206

Denial of Service in Tensorflow

9.0 CriticalFix available

In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, changing the TensorFlow's SavedModel protocol buffer and altering the name of required keys results in segfaults and data corruption while loading the model. This can cause a denial of service in products using tensorflow-serving or other inference-as-a-service installments. Fixed were added in commits f760f88b4267d981e13f4b302c437ae800445968 and fcfef195637c6e365577829c4d67681695956e7d (both going into TensorFlow 2.2.0 and 2.3.0 but not yet backported to earlier versions). However, this was not enough, as #41097 reports a different failure mode. The issue is patched in commit adf095206f25471e864a8e63a0f1caef53a0e3a6, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.96%Down 0.3 points since Apr 14, 2021
90%50%10%1%

What each source reports

CVE List Score used 9.0

Denial of Service in Tensorflow

In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, changing the TensorFlow's SavedModel protocol buffer and altering the name of required keys results in segfaults and data corruption while loading the model. This can cause a denial of service in products using tensorflow-serving or other inference-as-a-service installments. Fixed were added in commits f760f88b4267d981e13f4b302c437ae800445968 and fcfef195637c6e365577829c4d67681695956e7d (both going into TensorFlow 2.2.0 and 2.3.0 but not yet backported to earlier versions). However, this was not enough, as #41097 reports a different failure mode. The issue is patched in commit adf095206f25471e864a8e63a0f1caef53a0e3a6, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

Record
CVE-2020-15206
CVSS 3.1
9.0 CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-20
Updated
2026-11-02
EUVDEUVD-2020-0202 9.0

In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, changing the TensorFlow's SavedModel protocol buffer and altering the name of required keys results in segfaults and data corruption while loading the model. This can cause a denial of service in products using tensorflow-serving or other inference-as-a-service installments. Fixed were added in commits f760f88b4267d981e13f4b302c437ae800445968 and fcfef195637c6e365577829c4d67681695956e7d (both going into TensorFlow 2.2.0 and 2.3.0 but not yet backported to earlier versions). However, this was not enough, as #41097 reports a different failure mode. The issue is patched in commit adf095206f25471e864a8e63a0f1caef53a0e3a6, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

Record
EUVD-2020-0202
CVSS 3.1
9.0 CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-03
GitHub AdvisoriesGHSA-w5gh-2wr2-pm6g 7.1

Denial of Service in Tensorflow

Impact

Changing the TensorFlow's SavedModel protocol buffer and altering the name of required keys results in segfaults and data corruption while loading the model. This can cause a denial of service in products using tensorflow-serving or other inference-as-a-service installments.

We have added fixes to this in f760f88b4267d981e13f4b302c437ae800445968 and fcfef195637c6e365577829c4d67681695956e7d (both going into TensorFlow 2.2.0 and 2.3.0 but not yet backported to earlier versions). However, this was not enough, as #41097 reports a different failure mode.

Patches

We have patched the issue in adf095206f25471e864a8e63a0f1caef53a0e3a6 and will release patch releases for all versions between 1.15 and 2.3. Patch releases for versions between 1.15 and 2.1 will also contain cherry-picks of f760f88b4267d981e13f4b302c437ae800445968 and fcfef195637c6e365577829c4d67681695956e7d.

We recommend users to upgrade to TensorFlow 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by Shuaike Dong, from Alipay Tian Qian Security Lab && Lab for Applied Security Research, CUHK.

Record
GHSA-w5gh-2wr2-pm6g
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H
CVSS 3.1
9.0 CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-20
Updated
2026-11-02
NVD 9.0

In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, changing the TensorFlow's SavedModel protocol buffer and altering the name of required keys results in segfaults and data corruption while loading the model. This can cause a denial of service in products using tensorflow-serving or other inference-as-a-service installments. Fixed were added in commits f760f88b4267d981e13f4b302c437ae800445968 and fcfef195637c6e365577829c4d67681695956e7d (both going into TensorFlow 2.2.0 and 2.3.0 but not yet backported to earlier versions). However, this was not enough, as #41097 reports a different failure mode. The issue is patched in commit adf095206f25471e864a8e63a0f1caef53a0e3a6, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

Record
CVE-2020-15206
CVSS 3.1
9.0 CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-20
Updated
2026-11-02
OSV 7.5

In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, changing the TensorFlow's SavedModel protocol buffer and altering the name of required keys results in segfaults and data corruption while loading the model. This can cause a denial of service in products using tensorflow-serving or other inference-as-a-service installments. Fixed were added in commits f760f88b4267d981e13f4b302c437ae800445968 and fcfef195637c6e365577829c4d67681695956e7d (both going into TensorFlow 2.2.0 and 2.3.0 but not yet backported to earlier versions). However, this was not enough, as #41097 reports a different failure mode. The issue is patched in commit adf095206f25471e864a8e63a0f1caef53a0e3a6, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

Record
CVE-2020-15206
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVGHSA-w5gh-2wr2-pm6g 7.1

Denial of Service in Tensorflow

Impact

Changing the TensorFlow's SavedModel protocol buffer and altering the name of required keys results in segfaults and data corruption while loading the model. This can cause a denial of service in products using tensorflow-serving or other inference-as-a-service installments.

We have added fixes to this in f760f88b4267d981e13f4b302c437ae800445968 and fcfef195637c6e365577829c4d67681695956e7d (both going into TensorFlow 2.2.0 and 2.3.0 but not yet backported to earlier versions). However, this was not enough, as #41097 reports a different failure mode.

Patches

We have patched the issue in adf095206f25471e864a8e63a0f1caef53a0e3a6 and will release patch releases for all versions between 1.15 and 2.3. Patch releases for versions between 1.15 and 2.1 will also contain cherry-picks of f760f88b4267d981e13f4b302c437ae800445968 and fcfef195637c6e365577829c4d67681695956e7d.

We recommend users to upgrade to TensorFlow 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by Shuaike Dong, from Alipay Tian Qian Security Lab && Lab for Applied Security Research, CUHK.

Record
GHSA-w5gh-2wr2-pm6g
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H
CVSS 3.1
9.0 CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-20
Updated
2026-11-02
Show 6 moreShow less
OSVBIT-tensorflow-2020-15206 No score

Denial of Service in Tensorflow

In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, changing the TensorFlow's SavedModel protocol buffer and altering the name of required keys results in segfaults and data corruption while loading the model. This can cause a denial of service in products using tensorflow-serving or other inference-as-a-service installments. Fixed were added in commits f760f88b4267d981e13f4b302c437ae800445968 and fcfef195637c6e365577829c4d67681695956e7d (both going into TensorFlow 2.2.0 and 2.3.0 but not yet backported to earlier versions). However, this was not enough, as #41097 reports a different failure mode. The issue is patched in commit adf095206f25471e864a8e63a0f1caef53a0e3a6, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

Record
BIT-tensorflow-2020-15206
Updated
2026-11-02
OSVopenSUSE-SU-2020:1766-1 No score

Security update for tensorflow2

This update for tensorflow2 fixes the following issues:

  • updated to 2.1.2 with following fixes (boo#1177022):
    • Fixes an undefined behavior causing a segfault in tf.raw_ops.Switch (CVE-2020-15190)
    • Fixes three vulnerabilities in conversion to DLPack format (CVE-2020-15191, CVE-2020-15192, CVE-2020-15193)
    • Fixes two vulnerabilities in SparseFillEmptyRowsGrad (CVE-2020-15194, CVE-2020-15195)
    • Fixes an integer truncation vulnerability in code using the work sharder API (CVE-2020-15202)
    • Fixes a format string vulnerability in tf.strings.as_string (CVE-2020-15203)
    • Fixes segfault raised by calling session-only ops in eager mode (CVE-2020-15204)
    • Fixes data leak and potential ASLR violation from tf.raw_ops.StringNGrams (CVE-2020-15205)
    • Fixes segfaults caused by incomplete SavedModel validation (CVE-2020-15206)
    • Fixes a data corruption due to a bug in negative indexing support in TFLite (CVE-2020-15207)
    • Fixes a data corruption due to dimension mismatch in TFLite (CVE-2020-15208)
    • Fixes several vulnerabilities in TFLite saved model format (CVE-2020-15209, CVE-2020-15210, CVE-2020-15211)
Record
openSUSE-SU-2020:1766-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:12116-1 No score

tensorflow-lite-2.9.1-1.1 on GA media

These are all security issues fixed in the tensorflow-lite-2.9.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:12116-1
Updated
2026-11-02
OSVPYSEC-2020-129 No score

In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, changing the TensorFlow's SavedModel protocol buffer and altering the name of required keys results in segfaults and data corruption while loading the model. This can cause a denial of service in products using tensorflow-serving or other inference-as-a-service installments. Fixed were added in commits f760f88b4267d981e13f4b302c437ae800445968 and fcfef195637c6e365577829c4d67681695956e7d (both going into TensorFlow 2.2.0 and 2.3.0 but not yet backported to earlier versions). However, this was not enough, as #41097 reports a different failure mode. The issue is patched in commit adf095206f25471e864a8e63a0f1caef53a0e3a6, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

Record
PYSEC-2020-129
Updated
2026-11-02
OSVPYSEC-2020-286 No score

In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, changing the TensorFlow's SavedModel protocol buffer and altering the name of required keys results in segfaults and data corruption while loading the model. This can cause a denial of service in products using tensorflow-serving or other inference-as-a-service installments. Fixed were added in commits f760f88b4267d981e13f4b302c437ae800445968 and fcfef195637c6e365577829c4d67681695956e7d (both going into TensorFlow 2.2.0 and 2.3.0 but not yet backported to earlier versions). However, this was not enough, as #41097 reports a different failure mode. The issue is patched in commit adf095206f25471e864a8e63a0f1caef53a0e3a6, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

Record
PYSEC-2020-286
Updated
2026-11-02
OSVPYSEC-2020-321 No score

In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, changing the TensorFlow's SavedModel protocol buffer and altering the name of required keys results in segfaults and data corruption while loading the model. This can cause a denial of service in products using tensorflow-serving or other inference-as-a-service installments. Fixed were added in commits f760f88b4267d981e13f4b302c437ae800445968 and fcfef195637c6e365577829c4d67681695956e7d (both going into TensorFlow 2.2.0 and 2.3.0 but not yet backported to earlier versions). However, this was not enough, as #41097 reports a different failure mode. The issue is patched in commit adf095206f25471e864a8e63a0f1caef53a0e3a6, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

Record
PYSEC-2020-321
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
tensorflow
PyPI
 before 1.15.4
1.15.4
tensorflow
PyPI
 2.0.0 up to 2.0.3
2.0.3
tensorflow
PyPI
 2.1.0 up to 2.1.2
2.1.2
tensorflow
PyPI
 2.2.0 to 2.2.0
2.2.1
tensorflow
PyPI
 2.3.0 to 2.3.0
2.3.1
tensorflow-cpu
PyPI
 before 1.15.4
1.15.4
tensorflow-cpu
PyPI
 2.0.0 up to 2.0.3
2.0.3
tensorflow-cpu
PyPI
 2.1.0 up to 2.1.2
2.1.2
tensorflow-cpu
PyPI
 2.2.0 to 2.2.0
2.2.1
tensorflow-cpu
PyPI
 2.3.0 to 2.3.0
2.3.1
Show 27 moreShow less
Affected packages
PackageAffectedFixed
tensorflow-gpu
PyPI
 before 1.15.4
1.15.4
tensorflow-gpu
PyPI
 2.0.0 up to 2.0.3
2.0.3
tensorflow-gpu
PyPI
 2.1.0 up to 2.1.2
2.1.2
tensorflow-gpu
PyPI
 2.2.0 to 2.2.0
2.2.1
tensorflow-gpu
PyPI
 2.3.0 to 2.3.0
2.3.1
tensorflow
Bitnami
 before 1.15.4, 2.0.0 up to 2.0.3, 2.1.0 up to 2.1.2, 2.2.0 up to 2.2.1, 2.3.0 up to 2.3.1
1.15.42.0.32.1.22.2.12.3.1
tensorflow
PyPI
 before 1.15.4, plus listed versions
0.12.00.12.11.0.01.0.11.1.0
Show 24 moreShow less
1.10.01.10.11.11.01.12.01.12.21.12.31.13.11.13.21.14.01.15.01.15.21.15.31.2.01.2.11.3.01.4.01.4.11.5.01.5.11.6.01.7.01.7.11.8.01.9.0
1.15.4
tensorflow
PyPI
 2.0.0 up to 2.0.3, plus listed versions
2.0.12.0.2
2.0.3
tensorflow
PyPI
 2.1.0 up to 2.1.2, plus listed versions
2.1.1
2.1.2
tensorflow
PyPI
 2.2.0 up to 2.2.1
2.2.1
tensorflow
PyPI
 2.3.0 up to 2.3.1
2.3.1
tensorflow-cpu
PyPI
 before 1.15.4, plus listed versions
1.15.0
1.15.4
tensorflow-cpu
PyPI
 2.1.0 up to 2.1.2, plus listed versions
2.1.1
2.1.2
tensorflow-cpu
PyPI
 2.2.0 up to 2.2.1
2.2.1
tensorflow-cpu
PyPI
 2.3.0 up to 2.3.1
2.3.1
tensorflow-gpu
PyPI
 before 1.15.4, plus listed versions
0.12.00.12.11.0.01.0.11.1.0
Show 24 moreShow less
1.10.01.10.11.11.01.12.01.12.21.12.31.13.11.13.21.14.01.15.01.15.21.15.31.2.01.2.11.3.01.4.01.4.11.5.01.5.11.6.01.7.01.7.11.8.01.9.0
1.15.4
tensorflow-gpu
PyPI
 2.0.0 up to 2.0.3, plus listed versions
2.0.12.0.2
2.0.3
tensorflow-gpu
PyPI
 2.1.0 up to 2.1.2, plus listed versions
2.1.1
2.1.2
tensorflow-gpu
PyPI
 2.2.0 up to 2.2.1
2.2.1
tensorflow-gpu
PyPI
 2.3.0 up to 2.3.1
2.3.1
tensorflow
PyPI
 before 1.15.4, 2.0.0 up to 2.0.3, 2.1.0 up to 2.1.2, 2.2.0 up to 2.2.1, 2.3.0 up to 2.3.1, plus listed versions
0.12.0rc00.12.0rc10.12.00.12.11.0.0
Show 45 moreShow less
1.0.11.1.0rc01.1.0rc11.1.0rc21.1.01.2.0rc01.2.0rc11.2.0rc21.2.01.2.11.3.0rc01.3.0rc11.3.0rc21.3.01.4.0rc01.4.0rc11.4.01.4.11.5.0rc01.5.0rc11.5.01.5.11.6.0rc01.6.0rc11.6.01.7.0rc01.7.0rc11.7.01.7.11.8.0rc01.8.0rc11.8.01.9.0rc01.9.0rc11.9.0rc21.9.01.10.0rc01.10.0rc11.10.01.10.11.11.0rc01.11.0rc11.11.0rc21.11.01.12.0rc0
1.15.42.0.32.1.22.2.12.3.1
tensorflow-cpu
PyPI
 before 1.15.4, 2.0.0 up to 2.0.3, 2.1.0 up to 2.1.2, 2.2.0 up to 2.2.1, 2.3.0 up to 2.3.1, plus listed versions
1.15.02.1.1
1.15.42.0.32.1.22.2.12.3.1
tensorflow-gpu
PyPI
 before 1.15.4, 2.0.0 up to 2.0.3, 2.1.0 up to 2.1.2, 2.2.0 up to 2.2.1, 2.3.0 up to 2.3.1, plus listed versions
0.12.00.12.11.0.01.0.11.1.0
Show 27 moreShow less
1.10.01.10.11.11.01.12.01.12.21.12.31.13.11.13.21.14.01.15.01.15.21.15.31.2.01.2.11.3.01.4.01.4.11.5.01.5.11.6.01.7.01.7.11.8.01.9.02.0.12.0.22.1.1
1.15.42.0.32.1.22.2.12.3.1
tensorflow2
openSUSE:Leap 15.2
From an advisory covering 16 CVEs
 before 2.1.2-lp152.7.3.1
2.1.2-lp152.7.3.1
tensorflow2-lite
openSUSE:Leap 15.2
From an advisory covering 16 CVEs
 before 2.1.2-lp152.7.3.1
2.1.2-lp152.7.3.1
tensorflow2_2_1_2-gnu-hpc
openSUSE:Leap 15.2
From an advisory covering 16 CVEs
 before 2.1.2-lp152.7.3.1
2.1.2-lp152.7.3.1
tensorflow2_2_1_2-gnu-openmpi2-hpc
openSUSE:Leap 15.2
From an advisory covering 16 CVEs
 before 2.1.2-lp152.7.3.1
2.1.2-lp152.7.3.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-15206 is a critical vulnerability (CVSS 9.0) in Google Tensorflow, published September 25, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.96%, the 61st percentile. Fixed in tensorflow 1.15.4.

References

Show 179 moreShow less
This page doesn't list everything

Left out here: 23 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open