What’s Vulnerable › Vulnerabilities

CVE-2021-41220: Use after free in `CollectiveReduceV2`

• Severity: medium (CVSS 4.6 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-11-05 · updated 2026-06-17
• Weakness: CWE-416

Description

TensorFlow is an open source platform for machine learning. In affected versions the async implementation of `CollectiveReduceV2` suffers from a memory leak and a use after free. This occurs due to the asynchronous computation and the fact that objects that have been `std::move()`d from are still accessed. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, as this version is the only one that is also affected.

Affected products

• tensorflow: from 2.6.0 before 2.6.1; 2.7.0-rc0, 2.7.0-rc1 — fixed in 2.6.1

How to fix

Upgrade to a fixed version: tensorflow 2.6.1. Check the vendor advisory for mitigations.

References

• https://github.com/tensorflow/tensorflow/commit/ca38dab9d3ee66c5de06f11af9a4b1200da5ef75
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-gpfh-jvf9-7wg5
• https://github.com/tensorflow/tensorflow/commit/ca38dab9d3ee66c5de06f11af9a4b1200da5ef75
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-gpfh-jvf9-7wg5

Get alerted when CVE-2021-41220 or the next vulnerability affects your stack