CVE-2021-37661

TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause a denial of service in `boosted_trees_create_quantile_stream_resource` by using negative arguments. The [implementation](https://github.com/tensorflow/tensorflow/blob/84d053187cb80d975ef2b9684d4b61981bca0c41/tensorflow/core/kernels/boosted_trees/quantile_ops.cc#L96) does not validate that `num_streams` only contains non-negative numbers. In turn, [this results in using this value to allocate memory](https://github.com/tensorflow/tensorflow/blob/84d053187cb80d975ef2b9684d4b61981bca0c41/tensorflow/core/kernels/boosted_trees/quantiles/quantile_stream_resource.h#L31-L40). However, `reserve` receives an unsigned integer so there is an implicit conversion from a negative value to a large positive unsigned. This results in a crash from the standard library. We have patched the issue in GitHub commit 8a84f7a2b5a2b27ecf88d25bad9ac777cd2f7992. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

• CWE-681
• CWE-681

• https://github.com/tensorflow/tensorflow/commit/8a84f7a2b5a2b27ecf88d25bad9ac777cd2f7992Patch, Third Party Advisory
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-gf88-j2mg-cc82Third Party Advisory
• https://github.com/tensorflow/tensorflow/commit/8a84f7a2b5a2b27ecf88d25bad9ac777cd2f7992Patch, Third Party Advisory
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-gf88-j2mg-cc82Third Party Advisory

Published

Aug 12, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-37656TensorFlow is an end-to-end open source platform for machine…7.8
• CVE-2021-37657TensorFlow is an end-to-end open source platform for machine…7.8
• CVE-2021-37658TensorFlow is an end-to-end open source platform for machine…7.8
• CVE-2021-37659TensorFlow is an end-to-end open source platform for machine…7.8
• CVE-2021-3766objection.js is vulnerable to Improperly Controlled Modifica…9.8
• CVE-2021-37660TensorFlow is an end-to-end open source platform for machine…5.5
• CVE-2021-37662TensorFlow is an end-to-end open source platform for machine…7.8
• CVE-2021-37663TensorFlow is an end-to-end open source platform for machine…7.8
• CVE-2021-37664TensorFlow is an end-to-end open source platform for machine…7.1
• CVE-2021-37665TensorFlow is an end-to-end open source platform for machine…7.8
• CVE-2021-37666TensorFlow is an end-to-end open source platform for machine…7.8
• CVE-2021-37667TensorFlow is an end-to-end open source platform for machine…7.8