Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-xcqv-4f46-zuhf
Vulnerability ID VCID-xcqv-4f46-zuhf
Aliases CVE-2022-35935
GHSA-97p7-w86h-vcf9
Summary TensorFlow is an open source platform for machine learning. The implementation of SobolSampleOp is vulnerable to a denial of service via CHECK-failure (assertion failure) caused by assuming `input(0)`, `input(1)`, and `input(2)` to be scalar. This issue has been patched in GitHub commit c65c67f88ad770662e8f191269a907bf2b94b1bf. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-617 Reachable Assertion
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00093 https://api.first.org/data/v1/epss?cve=CVE-2022-35935
epss 0.00093 https://api.first.org/data/v1/epss?cve=CVE-2022-35935
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-97p7-w86h-vcf9
cvssv3.1 5.9 https://github.com/tensorflow/tensorflow
generic_textual MODERATE https://github.com/tensorflow/tensorflow
cvssv3.1 5.9 https://github.com/tensorflow/tensorflow/commit/c65c67f88ad770662e8f191269a907bf2b94b1bf
generic_textual MODERATE https://github.com/tensorflow/tensorflow/commit/c65c67f88ad770662e8f191269a907bf2b94b1bf
ssvc Track https://github.com/tensorflow/tensorflow/commit/c65c67f88ad770662e8f191269a907bf2b94b1bf
cvssv3.1 5.9 https://github.com/tensorflow/tensorflow/releases/tag/v2.10.0
generic_textual MODERATE https://github.com/tensorflow/tensorflow/releases/tag/v2.10.0
cvssv3.1 5.9 https://github.com/tensorflow/tensorflow/security/advisories/GHSA-97p7-w86h-vcf9
cvssv3.1_qr MODERATE https://github.com/tensorflow/tensorflow/security/advisories/GHSA-97p7-w86h-vcf9
generic_textual MODERATE https://github.com/tensorflow/tensorflow/security/advisories/GHSA-97p7-w86h-vcf9
ssvc Track https://github.com/tensorflow/tensorflow/security/advisories/GHSA-97p7-w86h-vcf9
cvssv3.1 5.9 https://nvd.nist.gov/vuln/detail/CVE-2022-35935
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2022-35935
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2022-35935
https://github.com/tensorflow/tensorflow
https://github.com/tensorflow/tensorflow/releases/tag/v2.10.0
c65c67f88ad770662e8f191269a907bf2b94b1bf https://github.com/tensorflow/tensorflow/commit/c65c67f88ad770662e8f191269a907bf2b94b1bf
CVE-2022-35935 https://nvd.nist.gov/vuln/detail/CVE-2022-35935
GHSA-97p7-w86h-vcf9 https://github.com/advisories/GHSA-97p7-w86h-vcf9
GHSA-97p7-w86h-vcf9 https://github.com/tensorflow/tensorflow/security/advisories/GHSA-97p7-w86h-vcf9
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/tensorflow/tensorflow
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/tensorflow/tensorflow/commit/c65c67f88ad770662e8f191269a907bf2b94b1bf
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-23T14:00:14Z/ Found at https://github.com/tensorflow/tensorflow/commit/c65c67f88ad770662e8f191269a907bf2b94b1bf
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/tensorflow/tensorflow/releases/tag/v2.10.0
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/tensorflow/tensorflow/security/advisories/GHSA-97p7-w86h-vcf9
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-23T14:00:14Z/ Found at https://github.com/tensorflow/tensorflow/security/advisories/GHSA-97p7-w86h-vcf9
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2022-35935
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.2608
EPSS Score 0.00093
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T17:38:28.627438+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2022/35xxx/CVE-2022-35935.json 38.6.0