{"id":"CVE-2021-41225","details":"TensorFlow is an open source platform for machine learning. In affected versions TensorFlow's Grappler optimizer has a use of unitialized variable. If the `train_nodes` vector (obtained from the saved model that gets optimized) does not contain a `Dequeue` node, then `dequeue_node` is left unitialized. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.","aliases":["BIT-tensorflow-2021-41225","GHSA-7r94-xv9v-63jw","PYSEC-2021-417","PYSEC-2021-634","PYSEC-2021-832"],"modified":"2026-07-09T11:34:19.673356Z","published":"2021-11-05T23:15:08.543Z","related":["openSUSE-SU-2024:12116-1"],"references":[{"type":"FIX","url":"https://github.com/tensorflow/tensorflow/commit/68867bf01239d9e1048f98cbad185bf4761bedd3"},{"type":"FIX","url":"https://github.com/tensorflow/tensorflow/security/advisories/GHSA-7r94-xv9v-63jw"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/tensorflow/tensorflow","events":[{"introduced":"582c8d236cb079023657287c318ff26adb239002"},{"fixed":"64918868e2154b06c7479347a59a4230f785e9fa"},{"introduced":"a4dfb8d1a71385bd6d122e4f27f86dcebb96712d"},{"fixed":"957590ea15cc03ee2e00fc61934647d54836676f"},{"introduced":"919f693420e35d00c8d0a42100837ae3718f7927"},{"fixed":"3aa40c3ce9d16eae296f086bc4ac4d62deb2affc"},{"introduced":"ce35e5c3a8efdb8161c6a85c8fb9ffb5bbdc9ffd"},{"last_affected":"ff68385595088304cf772086b9a259a65b007622"},{"fixed":"68867bf01239d9e1048f98cbad185bf4761bedd3"}],"database_specific":{"extracted_events":[{"introduced":"2.4.0"},{"fixed":"2.4.4"},{"introduced":"2.5.0"},{"fixed":"2.5.2"},{"introduced":"2.6.0"},{"fixed":"2.6.1"},{"introduced":"2.7.0-rc0"},{"last_affected":"2.7.0-rc0"},{"introduced":"2.7.0-rc1"},{"last_affected":"2.7.0-rc1"}],"source":["CPE_RANGE","CPE_STRING","REFERENCES"],"cpe":["cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:*","cpe:2.3:a:google:tensorflow:2.7.0:rc0:*:*:*:*:*:*","cpe:2.3:a:google:tensorflow:2.7.0:rc1:*:*:*:*:*:*"]}}],"versions":["2.7.0-rc0","2.7.0-rc1","v2.7.0-rc1","v2.4.3","v2.6.0","v2.5.1","v2.7.0-rc0","v2.4.2","v2.5.0","v2.4.1","v2.4.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-41225.json","vanir_signatures_modified":"2026-07-09T11:34:19Z","vanir_signatures":[{"id":"CVE-2021-41225-33c2f6b4","signature_type":"Function","signature_version":"v1","source":"https://github.com/tensorflow/tensorflow/commit/68867bf01239d9e1048f98cbad185bf4761bedd3","target":{"function":"AutoParallel::Initialize","file":"tensorflow/core/grappler/optimizers/auto_parallel.cc"},"deprecated":false,"digest":{"function_hash":"180610580969140927055067451882379134742","length":3704}},{"digest":{"line_hashes":["26340680737136471685494781048478165544","200923769751318358354259941226017034130","143145563203881069735105784434339384513","129074365653674604154500076449681058460"],"threshold":0.9},"id":"CVE-2021-41225-419239f3","signature_type":"Line","signature_version":"v1","source":"https://github.com/tensorflow/tensorflow/commit/68867bf01239d9e1048f98cbad185bf4761bedd3","target":{"file":"tensorflow/core/grappler/optimizers/auto_parallel.cc"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/tensorflow/tensorflow/commit/68867bf01239d9e1048f98cbad185bf4761bedd3","target":{"file":"tensorflow/core/grappler/optimizers/auto_parallel_test.cc"},"deprecated":false,"digest":{"line_hashes":["264261961358461795946491763694796098193","182181293155884076037897373433176665312","108587633537507210242609878158511307392"],"threshold":0.9},"id":"CVE-2021-41225-6fd54706"}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}