-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PythonPython| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| tensorflow | pip | < 2.11.1 | 2.11.1 |
| tensorflow-cpu | pip | < 2.11.1 | 2.11.1 |
| tensorflow-gpu | pip | < 2.11.1 | 2.11.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper validation in fractional pooling operators. The commit diff shows both operators originally used 'pooling_ratio_[0] == 1 || pooling_ratio_[3] == 1' which incorrectly allowed configurations where only one dimension was valid. This violates the requirement that both batch (dim 0) and channel (dim 3) ratios must be 1.0. The CWE-415 (Double Free) manifests when invalid ratios trigger incorrect memory management in unsupported pooling scenarios. The direct code modification in core kernel files and corresponding test case additions confirm these are the vulnerable functions.
Ongoing coverage of React2Shell