Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-k3am-7v2s-xqb9
Vulnerability ID VCID-k3am-7v2s-xqb9
Aliases CVE-2022-35934
GHSA-f4w6-h4f5-wx45
Summary TensorFlow is an open source platform for machine learning. The implementation of tf.reshape op in TensorFlow is vulnerable to a denial of service via CHECK-failure (assertion failure) caused by overflowing the number of elements in a tensor. This issue has been patched in GitHub commit 61f0f9b94df8c0411f0ad0ecc2fec2d3f3c33555. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-617 Reachable Assertion
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2022-35934
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2022-35934
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-f4w6-h4f5-wx45
cvssv3.1 5.9 https://github.com/tensorflow/tensorflow
generic_textual MODERATE https://github.com/tensorflow/tensorflow
cvssv3.1 5.9 https://github.com/tensorflow/tensorflow/commit/61f0f9b94df8c0411f0ad0ecc2fec2d3f3c33555
generic_textual MODERATE https://github.com/tensorflow/tensorflow/commit/61f0f9b94df8c0411f0ad0ecc2fec2d3f3c33555
ssvc Track https://github.com/tensorflow/tensorflow/commit/61f0f9b94df8c0411f0ad0ecc2fec2d3f3c33555
cvssv3.1 5.9 https://github.com/tensorflow/tensorflow/releases/tag/v2.10.0
generic_textual MODERATE https://github.com/tensorflow/tensorflow/releases/tag/v2.10.0
cvssv3.1 5.9 https://github.com/tensorflow/tensorflow/security/advisories/GHSA-f4w6-h4f5-wx45
cvssv3.1_qr MODERATE https://github.com/tensorflow/tensorflow/security/advisories/GHSA-f4w6-h4f5-wx45
generic_textual MODERATE https://github.com/tensorflow/tensorflow/security/advisories/GHSA-f4w6-h4f5-wx45
ssvc Track https://github.com/tensorflow/tensorflow/security/advisories/GHSA-f4w6-h4f5-wx45
cvssv3.1 5.9 https://nvd.nist.gov/vuln/detail/CVE-2022-35934
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2022-35934
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2022-35934
https://github.com/tensorflow/tensorflow
https://github.com/tensorflow/tensorflow/commit/61f0f9b94df8c0411f0ad0ecc2fec2d3f3c33555
https://github.com/tensorflow/tensorflow/releases/tag/v2.10.0
https://github.com/tensorflow/tensorflow/security/advisories/GHSA-f4w6-h4f5-wx45
https://nvd.nist.gov/vuln/detail/CVE-2022-35934
GHSA-f4w6-h4f5-wx45 https://github.com/advisories/GHSA-f4w6-h4f5-wx45
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/tensorflow/tensorflow
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/tensorflow/tensorflow/commit/61f0f9b94df8c0411f0ad0ecc2fec2d3f3c33555
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-23T14:00:20Z/ Found at https://github.com/tensorflow/tensorflow/commit/61f0f9b94df8c0411f0ad0ecc2fec2d3f3c33555
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/tensorflow/tensorflow/releases/tag/v2.10.0
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/tensorflow/tensorflow/security/advisories/GHSA-f4w6-h4f5-wx45
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-23T14:00:20Z/ Found at https://github.com/tensorflow/tensorflow/security/advisories/GHSA-f4w6-h4f5-wx45
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2022-35934
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.12644
EPSS Score 0.00041
Published At June 4, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-04T17:12:22.266379+00:00 Debian Importer Import https://security-tracker.debian.org/tracker/data/json 38.6.0