Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-4r56-jkdr-6bg5
Vulnerability ID VCID-4r56-jkdr-6bg5
Aliases CVE-2022-35985
GHSA-9942-r22v-78cp
Summary TensorFlow is an open source platform for machine learning. If `LRNGrad` is given an `output_image` input tensor that is not 4-D, it results in a `CHECK` fail that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit bd90b3efab4ec958b228cd7cfe9125be1c0cf255. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-617 Reachable Assertion
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00064 https://api.first.org/data/v1/epss?cve=CVE-2022-35985
epss 0.00064 https://api.first.org/data/v1/epss?cve=CVE-2022-35985
epss 0.00064 https://api.first.org/data/v1/epss?cve=CVE-2022-35985
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-9942-r22v-78cp
cvssv3.1 5.9 https://github.com/tensorflow/tensorflow
generic_textual MODERATE https://github.com/tensorflow/tensorflow
cvssv3.1 5.9 https://github.com/tensorflow/tensorflow/commit/bd90b3efab4ec958b228cd7cfe9125be1c0cf255
generic_textual MODERATE https://github.com/tensorflow/tensorflow/commit/bd90b3efab4ec958b228cd7cfe9125be1c0cf255
ssvc Track https://github.com/tensorflow/tensorflow/commit/bd90b3efab4ec958b228cd7cfe9125be1c0cf255
cvssv3.1 5.9 https://github.com/tensorflow/tensorflow/releases/tag/v2.10.0
generic_textual MODERATE https://github.com/tensorflow/tensorflow/releases/tag/v2.10.0
cvssv3.1 5.9 https://github.com/tensorflow/tensorflow/security/advisories/GHSA-9942-r22v-78cp
cvssv3.1_qr MODERATE https://github.com/tensorflow/tensorflow/security/advisories/GHSA-9942-r22v-78cp
generic_textual MODERATE https://github.com/tensorflow/tensorflow/security/advisories/GHSA-9942-r22v-78cp
ssvc Track https://github.com/tensorflow/tensorflow/security/advisories/GHSA-9942-r22v-78cp
cvssv3.1 5.9 https://nvd.nist.gov/vuln/detail/CVE-2022-35985
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2022-35985
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2022-35985
https://github.com/tensorflow/tensorflow
https://github.com/tensorflow/tensorflow/releases/tag/v2.10.0
bd90b3efab4ec958b228cd7cfe9125be1c0cf255 https://github.com/tensorflow/tensorflow/commit/bd90b3efab4ec958b228cd7cfe9125be1c0cf255
CVE-2022-35985 https://nvd.nist.gov/vuln/detail/CVE-2022-35985
GHSA-9942-r22v-78cp https://github.com/advisories/GHSA-9942-r22v-78cp
GHSA-9942-r22v-78cp https://github.com/tensorflow/tensorflow/security/advisories/GHSA-9942-r22v-78cp
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/tensorflow/tensorflow
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/tensorflow/tensorflow/commit/bd90b3efab4ec958b228cd7cfe9125be1c0cf255
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-23T13:59:00Z/ Found at https://github.com/tensorflow/tensorflow/commit/bd90b3efab4ec958b228cd7cfe9125be1c0cf255
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/tensorflow/tensorflow/releases/tag/v2.10.0
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/tensorflow/tensorflow/security/advisories/GHSA-9942-r22v-78cp
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-23T13:59:00Z/ Found at https://github.com/tensorflow/tensorflow/security/advisories/GHSA-9942-r22v-78cp
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2022-35985
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.20193
EPSS Score 0.00064
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T17:38:24.625526+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2022/35xxx/CVE-2022-35985.json 38.6.0