Skip to main content

Mondoo

Vulnerability Management
Technology
Services

Solutions

Financial Services
Manufacturing
Healthcare

Resources

Blog
Vulnerability Database
Documentation
GitHub

Company

About
Careers
Partners
Contact

Legal

Privacy
Terms
Imprint

© 2026 Mondoo, Inc.

Log in Get Assessment

Vulnerability IntelligencePYSEC-2026-3261

PYSEC-2026-3261

HIGH7.1

PYSEC-2026-3261

Published Jul 13, 2026

Modified 3 months ago

Fix available

Details

Impact

An input pooling_ratio that is smaller than 1 will trigger a heap OOB in tf.raw_ops.FractionalMaxPool and tf.raw_ops.FractionalAvgPool.

Patches

We have patched the issue in GitHub commit 216525144ee7c910296f5b05d214ca1327c9ce48.

The fix will be included in TensorFlow 2.11.0. We will also cherry pick this commit on TensorFlow 2.10.1.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Affected Packages

tensorflow

PyPI

Affected versions:

0.12.00.12.11.0.01.0.11.1.01.10.01.10.11.11.01.12.01.12.2+75 more

Fixed in:

2.8.42.9.32.10.1

References

https://github.com/advisories/GHSA-xvwp-h6jv-7472

https://github.com/tensorflow/tensorflow

https://github.com/tensorflow/tensorflow/commit/216525144ee7c910296f5b05d214ca1327c9ce48

https://github.com/tensorflow/tensorflow/security/advisories/GHSA-xvwp-h6jv-7472

https://nvd.nist.gov/vuln/detail/CVE-2022-41900

https://pypi.org/project/tensorflow

Aliases

CVE-2022-41900 GHSA-xvwp-h6jv-7472

CVSS Analysis

CVSS v3.1

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

HighAC:H

Privileges Required

LowPR:L

User Interaction

RequiredUI:R

Scope

Scope

UnchangedS:U

Impact

Confidentiality

HighC:H

Integrity

HighI:H

Availability

HighA:H

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Related

Ecosystems

Timeline

PublishedJul 13, 2026

ModifiedJul 13, 2026

PYSEC-2026-3261 | Mondoo Vulnerability Intelligence