Skip to content
TensorFlowGHSA-xqfj-cr6q-pc8w

Crash in `tf.transpose` with complex inputs

Low2.5CVE-2021-29618 · Published May 21, 2021 · updated Sep 10, 2026

### Impact Passing a complex argument to `tf.transpose` at the same time as passing `conjugate=True` argument results in a crash: ```python import tensorflow as tf tf.transpose(conjugate=True, a=complex(1)) ``` ### Patches We have received a patch for the issue in GitHub commit [1dc6a7ce6e0b3e27a7ae650bfc05b195ca793f88](https://github.com/tensorflow/tensorflow/commit/1dc6a7ce6e0b3e27a7ae650bfc05b195ca793f88). The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range. ### For more information Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions. ### Attribution This vulnerability has been reported in [#42105](https://github.com/tensorflow/issues/42105) and fixed in [#46973](https://github.com/tensorflow/issues/46973).

GitHub advisory

Affected versions

PackageAffectedFixed in
tensorflow
PyPI
< 2.1.42.1.4
>= 2.2.0, < 2.2.32.2.3
>= 2.3.0, < 2.3.32.3.3
>= 2.4.0, < 2.4.22.4.2
Details and references

More TensorFlow advisories

All TensorFlow
Advisory
Segfault in `tf.raw_ops.SparseCountSparseOutput`
Low2.5May 21, 2021
Crash in `tf.strings.substr` due to `CHECK`-fail
Low2.5May 21, 2021
Null dereference in Grappler's `TrySimplify`
Low2.5May 21, 2021
Stack overflow in `ParseAttrValue` with nested tensors
Low2.5May 21, 2021
Interpreter crash from `tf.io.decode_raw`
Medium7.1May 21, 2021
Incomplete validation in `tf.raw_ops.CTCLoss`
Medium6.3May 21, 2021

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.

Double opt-in. Unsubscribe any time.