Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
🐍
🐍 PyPI
Not in CISA KEV
MEDIUM severity

GHSA-m648-33qf-v3gp

MEDIUMFix: tensorflow/tensorflow@1475541

GHSA-m648-33qf-v3gp is a medium-severity (CVSS 4.4) Improper Input Validation vulnerability in tensorflow. O3 Security confirms whether GHSA-m648-33qf-v3gp is actually reachable in your code before you act, and blocks exploitation at runtime until you patch.

CHECK-fail in LSTM with zero-length input in TensorFlow

Also known asBIT-tensorflow-2020-26270CVE-2020-26270PYSEC-2020-256PYSEC-2020-301PYSEC-2020-336
Published
Dec 10, 2020
Updated
Jul 8, 2026
Affected
15 pkgs
Patched
15 / 15
Exploits
None indexed
Exploitation data as of Jul 8, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Real-World Exposure

15 pkgs affected
🐍tensorflow🐍tensorflow🐍tensorflow🐍tensorflow🐍tensorflow🐍tensorflow-cpu🐍tensorflow-cpu🐍tensorflow-cpu+7 more

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.

Description

Impact

Running an LSTM/GRU model where the LSTM/GRU layer receives an input with zero-length results in a CHECK failure when using the CUDA backend.

This can result in a query-of-death vulnerability, via denial of service, if users can control the input to the layer.

Patches

We have patched the issue in GitHub commit 14755416e364f17fb1870882fa778c7fec7f16e3 and will release TensorFlow 2.4.0 containing the patch. TensorFlow nightly packages after this commit will also have the issue resolved.

Since this issue also impacts TF versions before 2.4, we will patch all releases between 1.15 and 2.3 inclusive.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Affected Packages

15 total 15 fixed
EcosystemPackageVulnerable rangeFix
🐍PyPItensorflowall versions1.15.5
🐍PyPItensorflow2.0.0&&< 2.0.42.0.4
🐍PyPItensorflow2.1.0&&< 2.1.32.1.3
🐍PyPItensorflow2.2.0&&< 2.2.22.2.2
🐍PyPItensorflow2.3.0&&< 2.3.22.3.2
🐍PyPItensorflow-cpuall versions1.15.5

Detection & mitigation playbook

Open-source dependency
  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for tensorflow. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.

  2. Fix

    Update tensorflow to 1.15.5 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-m648-33qf-v3gp is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

  4. How O3 protects you

    O3 pinpoints whether GHSA-m648-33qf-v3gp is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.

Tailored to GHSA-m648-33qf-v3gp. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.

Frequently Asked Questions

### Impact Running an LSTM/GRU model where the LSTM/GRU layer receives an input with zero-length results in a `CHECK` failure when using the CUDA backend. This can result in a query-of-death vulnerability, via denial of service, if users can control the input to the layer. ### Patches We have patched the issue in GitHub commit [14755416e364f17fb1870882fa778c7fec7f16e3](https://github.com/tensorflow/tensorflow/commit/14755416e364f17fb1870882fa778c7fec7f16e3) and will release TensorFlow 2.4.0 containing the patch. TensorFlow nightly packages after this commit will also have the issue resolved.
O3 Security · Impact-Aware SCA

Is GHSA-m648-33qf-v3gp in your dependencies?

O3 detects GHSA-m648-33qf-v3gp across PyPI dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.