{"id":"CVE-2022-36026","summary":"`CHECK` fail in `QuantizeAndDequantizeV3` in TensorFlow","details":"TensorFlow is an open source platform for machine learning. If `QuantizeAndDequantizeV3` is given a nonscalar `num_bits` input tensor, it results in a `CHECK` fail that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit f3f9cb38ecfe5a8a703f2c4a8fead434ef291713. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.","aliases":["BIT-tensorflow-2022-36026","GHSA-9cr2-8pwr-fhfq","PYSEC-2026-3149","PYSEC-2026-3304","PYSEC-2026-976"],"modified":"2026-08-12T13:32:08.671257Z","published":"2022-09-16T22:05:20Z","related":["openSUSE-SU-2024:12355-1"],"database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-617"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36026.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36026.json"},{"type":"ADVISORY","url":"https://github.com/tensorflow/tensorflow/security/advisories/GHSA-9cr2-8pwr-fhfq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-36026"},{"type":"FIX","url":"https://github.com/tensorflow/tensorflow/commit/f3f9cb38ecfe5a8a703f2c4a8fead434ef291713"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/tensorflow/tensorflow","events":[{"introduced":"0"},{"fixed":"dd7b8a3c1714d0052ce4b4a2fd8dcef927439a24"},{"introduced":"3f878cff5b698b82eea85db2b60d65a2e320850e"},{"fixed":"0516d4d8bced506cae97dc3cb45dbd2fe4311f26"},{"introduced":"8a20d54a3c1bfa38c03ea99a2ad3c1b0a45dfa95"},{"fixed":"d8ce9f9c301d021a69953134185ab728c1c248d3"},{"fixed":"f3f9cb38ecfe5a8a703f2c4a8fead434ef291713"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"2.7.2"},{"introduced":"2.8.0"},{"fixed":"2.8.1"},{"introduced":"2.9.0"},{"fixed":"2.9.1"}],"source":["CPE_RANGE","REFERENCES"],"cpe":"cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:*"}}],"versions":["v2.9.0","v2.7.1","v2.8.0","v2.7.0","v2.7.0-rc1","v2.7.0-rc0","v1.12.1","v1.9.0-rc2","v1.6.0-rc1","v1.1.0-rc2","v1.1.0-rc1","0.6.0","0.5.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-36026.json","vanir_signatures_modified":"2026-08-12T13:32:08Z","vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["320946868603612008577978215287775675178","250807895491663025306746636982733724940","195151488333586858317300471543446597211","251757871033240489635059113861945391079","62413719966057941066990561161223677203","68069601771067356563745578737176459591","270335157287316531476158674839533630672","297475357450778150719209251382290468287","12580976843360316445646175015395965143","60273947114378708600549514519423100348","83951950775522996153541642463375565806","248211774107645160762535927518105006408","314433021037823667743230938161662137578","157779392725490788060608206825945647439","98752423486938042043100089518823024221","165524640026459368734417511510180083919","68119851600575145836980280872865783127","216296550666802067485939164949692238330","40633720451396884721352403170056067795","125435192100293902248940422295538402133","37406002882678900548400997815697527255","120129371249890519937293700333636251787","93882842870522522745409834848949112720","298002771654236147863049566382114144666","288809565933839217161412638839370178712","120940342315185072862833130865343353024","186389348793549679601490028815025313093","326332239934340812861917022565582917839","167881766028211680008515531696682178636","72487360836476412162985234184527897525","242237634242932320829107658376860409934","196528999694878397680832147136605328706","221808762180343201952842464814082321558","135212574878263065861950315433123717478","323849748189963150899689227639271219087","63443454412396137731546615178900389403","223162569209721740619659131995650046424","35268681461756809221248354898226430792","152663405596194807601645432710611673342","112916918786204299803300901649037236146","196253126112772665778809683812457238966","10618210487815673673621411280238708491","102223482759834184605700093166856803696","152213820078847477454797613586169290457","70818227253057647622753778125010184453","160080437253760478513796064619151953872","311204902054503622557327668433623093671","238380180145272161117441559275354139787","50995730458285697651740514915243328708","106559017717881365450575608671705197011","265195342510919217383514433518126697116","151448620018506122208557331337702881643","214450989152407921240356743103558430345","121408085887659691650990265188826076622","6432624729199104447152617304821233543","187398899908867881876607858053181892092","296054089582975300100856257774701140259","260903557295013206408991866202863362197","203959507385160756312166509783854221634","108549133195003503424071768905771600841","172431067418874262899678414475055712787","328410409011571087435019009371056899742","176068773716387915431679173772228483723","114385610600751223390050691946914303063","44974332606769355029881314166748675237","124150353756745084172486150821831194337","44086241670994531431480837558325486087","81001124421093499313162321782184469197","104680593146700920269664370061717685057","193186815115717833949824568386018591281","141389913203323895025341986638092435522","61351432838858345100926409355393055148","245118309824196580630817192807279978553","319747782364554568616449410461961004892","262038564093232148747499950569053596162","96236644004925086130407867739192196424","165330796406008089260766647002801778729","140592593438381568050295411617449087035","240872523075096101842524600907581902177","9347344204997713836050031723045500686","188053712179998710171224152685516892462","121923791067897803565709342803165173739","211859969666084931291707684936730506715","89255216284449161963402263052054665615","161821415853939768981808393037081108572","57381418005432231950009982356643379327","80408356396281715040334577589913065351","58218232228649745962287971277249126251","105494615101264712795715668037298748097","274448397555179310608373203582371868471","137300747163261298122547159751376609406","50949660637236645881225714706658584167","331350595093833680178834881722871940841","183400060387409692160449264444831741851","126910655021354832531925528257564827342","214094142796654208704345876851746281696","117145265622366844253632471554187799505","37963444184757056429221603548844309577","180433044654261999970201967011987458461","256540087295119680388771959420921695942","66157545862943606185094779368490037895","123175794021486707551668549470849687025","162639787909240165361487862387425557505","150483758690138676560796267508439317535","273093206859432553887881910895461421396","300933138228694241357812732075191846179","158776625342749649094317427261370731473","268802320201150364516968143516102295095","182660795220506503832865472298502237678","85689904898136374881455632243163880512","255514143036197963192828300885028733092","50936351734651685171791179253099243774","7041765078371615514553176698099308001","135212574878263065861950315433123717478","323849748189963150899689227639271219087","63443454412396137731546615178900389403","223162569209721740619659131995650046424","35268681461756809221248354898226430792","152663405596194807601645432710611673342","112916918786204299803300901649037236146","196253126112772665778809683812457238966","10618210487815673673621411280238708491","102223482759834184605700093166856803696","152213820078847477454797613586169290457","70818227253057647622753778125010184453","160080437253760478513796064619151953872","311204902054503622557327668433623093671","238380180145272161117441559275354139787","50995730458285697651740514915243328708","106559017717881365450575608671705197011","265195342510919217383514433518126697116","255343177848217678147712184019203040281","98752423486938042043100089518823024221","165524640026459368734417511510180083919","257610417680528383360067782899133586886","102709051769963026297396359825234425197","308066696073589119411778724289358866445","14923784381347755439297534618487566110","196975828530763773343678264972370355741","180401563299336270631567026646415895019","162042353301627575825491304591790601598","244485986585576106902964117664241411860","27288212276158149660646944083245427477","132424626160269363169734872728535143469","260292850310221076088154381469886827694","312071254463774638340031326647364386965","327105352149007959104348862961632291038","151447640736106122407602177561697884360","101216043683800580569541905919291029955","126414898412645941932277197609556320863","54512723288228429314697969949132621545","334443318673284341295964229695881056763","252862087094246250720962805518538696247","312763170420712740326438446436982595674","209901431143833256849466667049668286028","38116345544717581139728070392462594483","6378607702506183213844845083576550907","2171292054862950480452682213883941111","149482442653368120553279842286482915581","5793348461404875007709931543837711402","123689014814863601156704590728674828969","44366595858492462585202179387303329475","57210465193355966102489830897323299669","203172006188069174386920802271232617948","293150768047238285104823369948973087079","162816403801765027730324222426971835130","57735619199930214353944896330217149728","38116345544717581139728070392462594483","6378607702506183213844845083576550907","292498444495709571095043926516238546708","196890666508205078539414700210878531793","277403321522378940409054506975125818368","255041166316690302069000122458387373629","327783546434018817701237804973968875054","197728945300409313214200875712123489736","218499678993784009250816688985989327239","88608737910703681747028054200503580570","179603967530106576836855161405074308741","186043667828811279135267519697947805157","332837853078024161470762350570372793348","231559569223963288947989485345540195913","298581522425203180987296499396242745606","19019897720687684337580699258442413575","47419992128344641472471643321354254843","176238833166838878303776079806759669861","257490797168453460204920954215047899343","255726954299539718393477074543575520306","202799123264211559975417168825563664726","176430767582464877028331442151802168163","265059053478912760722606726203440277489","152914035479768528424705244949881547687","183343003540743561725584724598397112583","298581522425203180987296499396242745606","117020121889963068107004283935959140643","102810133582096526573140626556746056896","167960828145502038191534326664574886858","135827785187853460336528657385617109201","312700070588745209718715584829917647061","15538294706436537661764463668419754243","45854121592468643787424987766914750714","297374837044985402727248313567301911583","253765883212437181427373920725564046552","112567236772940376282389138772799040930","187498034499434176924853861533449153485","159589170956141547437357105208556362329","298815958445381334827188788683948564069","247871743246201520512908077714890545682","192592410924261425693628451762159869403","207188176966505815347930020591445103551","278864702841094282243528104251824704988","282497480022807742942437613801719872725","132632202867681484240340297631956215418","44031483872540233727835354274412484274","211813423799959133279560130762390671986","288231824743127741517855034351935842251","266739892117510473559618097329452858329","71913646635267452356383661694909315489","299249471024501250250583470400272181687","101858628763416820959919655962928165491","133480403314996691832102824513440480163","63733219071101327114165567607668721744","35160919890541561496169086715499930513","185170879469538171732586328692604223473","74609352260190296737091000343913677389","328087995206796161945151903333048212206","208150662867094765104036332257787482353","141536577545913846536584673292661475532","257222325080238741383507070242718259558","297907898653400228660502033298207342662","304968082526732292191494999222341770215","30842938208817783971602625167247163726","297352863230882886753434719324166448586","133480403314996691832102824513440480163","139757097262624548634402909144575773038","58684334253058304161734460349894945891","32886128495374675503093382348567636101","221962566065519778332991700147277746762","297352863230882886753434719324166448586","54679871528435560348900161898145851335","52309224712977729475933830123194980790","245114676631931072062891082210532891875","290810127176654386167605960516793373910","253716791781315168199792672811018283637","140062645004362277403643836978755707178","92941246944412581407344813460099671243"],"threshold":0.9},"id":"CVE-2022-36026-8d4534d4","signature_type":"Line","signature_version":"v1","source":"https://github.com/tensorflow/tensorflow/commit/f3f9cb38ecfe5a8a703f2c4a8fead434ef291713","target":{"file":"tensorflow/core/kernels/quantize_and_dequantize_op.cc"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}