Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-ghqz-dfeq-rygz
Vulnerability ID VCID-ghqz-dfeq-rygz
Aliases CVE-2022-41884
GHSA-jq6x-99hj-q636
Summary TensorFlow is an open source platform for machine learning. If a numpy array is created with a shape such that one element is zero and the others sum to a large number, an error will be raised. We have patched the issue in GitHub commit 2b56169c16e375c521a3bc8ea658811cc0793784. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-670 Always-Incorrect Control Flow Implementation
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00133 https://api.first.org/data/v1/epss?cve=CVE-2022-41884
epss 0.00133 https://api.first.org/data/v1/epss?cve=CVE-2022-41884
epss 0.00133 https://api.first.org/data/v1/epss?cve=CVE-2022-41884
epss 0.00149 https://api.first.org/data/v1/epss?cve=CVE-2022-41884
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-jq6x-99hj-q636
cvssv3.1 4.8 https://github.com/tensorflow/tensorflow
generic_textual MODERATE https://github.com/tensorflow/tensorflow
cvssv3.1 4.8 https://github.com/tensorflow/tensorflow/commit/2b56169c16e375c521a3bc8ea658811cc0793784
generic_textual MODERATE https://github.com/tensorflow/tensorflow/commit/2b56169c16e375c521a3bc8ea658811cc0793784
cvssv3.1 4.8 https://github.com/tensorflow/tensorflow/security/advisories/GHSA-jq6x-99hj-q636
cvssv3.1_qr MODERATE https://github.com/tensorflow/tensorflow/security/advisories/GHSA-jq6x-99hj-q636
generic_textual MODERATE https://github.com/tensorflow/tensorflow/security/advisories/GHSA-jq6x-99hj-q636
cvssv3.1 4.8 https://nvd.nist.gov/vuln/detail/CVE-2022-41884
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2022-41884
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2022-41884
https://github.com/tensorflow/tensorflow
https://github.com/tensorflow/tensorflow/commit/2b56169c16e375c521a3bc8ea658811cc0793784
https://github.com/tensorflow/tensorflow/security/advisories/GHSA-jq6x-99hj-q636
https://nvd.nist.gov/vuln/detail/CVE-2022-41884
GHSA-jq6x-99hj-q636 https://github.com/advisories/GHSA-jq6x-99hj-q636
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H Found at https://github.com/tensorflow/tensorflow
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H Found at https://github.com/tensorflow/tensorflow/commit/2b56169c16e375c521a3bc8ea658811cc0793784
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H Found at https://github.com/tensorflow/tensorflow/security/advisories/GHSA-jq6x-99hj-q636
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2022-41884
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.32381
EPSS Score 0.00133
Published At June 4, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-04T17:12:23.736000+00:00 Debian Importer Import https://security-tracker.debian.org/tracker/data/json 38.6.0