CVE-2021-37682

TensorFlow is an end-to-end open source platform for machine learning. In affected versions all TFLite operations that use quantization can be made to use unitialized values. [For example](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/lite/kernels/depthwise_conv.cc#L198-L200). The issue stems from the fact that `quantization.params` is only valid if `quantization.type` is different that `kTfLiteNoQuantization`. However, these checks are missing in large parts of the code. We have patched the issue in GitHub commits 537bc7c723439b9194a358f64d871dd326c18887, 4a91f2069f7145aab6ba2d8cfe41be8a110c18a5 and 8933b8a21280696ab119b63263babdb54c298538. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

• CWE-908

• https://github.com/tensorflow/tensorflow/commit/4a91f2069f7145aab6ba2d8cfe41be8a110c18a5Patch, Third Party Advisory
• https://github.com/tensorflow/tensorflow/commit/537bc7c723439b9194a358f64d871dd326c18887Patch, Third Party Advisory
• https://github.com/tensorflow/tensorflow/commit/8933b8a21280696ab119b63263babdb54c298538Patch, Third Party Advisory
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-4c4g-crqm-xrxwThird Party Advisory
• https://github.com/tensorflow/tensorflow/commit/4a91f2069f7145aab6ba2d8cfe41be8a110c18a5Patch, Third Party Advisory
• https://github.com/tensorflow/tensorflow/commit/537bc7c723439b9194a358f64d871dd326c18887Patch, Third Party Advisory
• https://github.com/tensorflow/tensorflow/commit/8933b8a21280696ab119b63263babdb54c298538Patch, Third Party Advisory
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-4c4g-crqm-xrxwThird Party Advisory

Published

Aug 12, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-37677TensorFlow is an end-to-end open source platform for machine…5.5
• CVE-2021-37678TensorFlow is an end-to-end open source platform for machine…8.8
• CVE-2021-37679TensorFlow is an end-to-end open source platform for machine…7.8
• CVE-2021-3768bookstack is vulnerable to Improper Neutralization of Input …5.4
• CVE-2021-37680TensorFlow is an end-to-end open source platform for machine…5.5
• CVE-2021-37681TensorFlow is an end-to-end open source platform for machine…7.8
• CVE-2021-37683TensorFlow is an end-to-end open source platform for machine…5.5
• CVE-2021-37684TensorFlow is an end-to-end open source platform for machine…5.5
• CVE-2021-37685TensorFlow is an end-to-end open source platform for machine…5.5
• CVE-2021-37686TensorFlow is an end-to-end open source platform for machine…5.5
• CVE-2021-37687TensorFlow is an end-to-end open source platform for machine…5.5
• CVE-2021-37688TensorFlow is an end-to-end open source platform for machine…5.5