---
id: CVE-2021-29615
aliases:
  - GHSA-qw5h-7f53-xrp6
  - BIT-tensorflow-2021-29615
  - PYSEC-2021-252
  - PYSEC-2021-543
  - PYSEC-2021-741
title: Stack overflow in `ParseAttrValue` with nested tensors
summary: Stack overflow in `ParseAttrValue` with nested tensors
severity: low
cvss: 2.5
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L'
vendor: tensorflow
product: tensorflow
ecosystem: pip
affected:
  - tensorflow < 2.1.4
  - 'tensorflow >= 2.2.0, < 2.2.3'
  - 'tensorflow >= 2.3.0, < 2.3.3'
  - 'tensorflow >= 2.4.0, < 2.4.2'
  - tensorflow-cpu < 2.1.4
  - 'tensorflow-cpu >= 2.2.0, < 2.2.3'
  - 'tensorflow-cpu >= 2.3.0, < 2.3.3'
  - 'tensorflow-cpu >= 2.4.0, < 2.4.2'
  - tensorflow-gpu < 2.1.4
  - 'tensorflow-gpu >= 2.2.0, < 2.2.3'
  - 'tensorflow-gpu >= 2.3.0, < 2.3.3'
  - 'tensorflow-gpu >= 2.4.0, < 2.4.2'
patched:
  - tensorflow 2.1.4
  - tensorflow 2.2.3
  - tensorflow 2.3.3
  - tensorflow 2.4.2
  - tensorflow-cpu 2.1.4
  - tensorflow-cpu 2.2.3
  - tensorflow-cpu 2.3.3
  - tensorflow-cpu 2.4.2
  - tensorflow-gpu 2.1.4
  - tensorflow-gpu 2.2.3
  - tensorflow-gpu 2.3.3
  - tensorflow-gpu 2.4.2
published: '2021-05-21'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:49:14.934304123Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-qw5h-7f53-xrp6'
references:
  - url: >-
      https://github.com/tensorflow/tensorflow/security/advisories/GHSA-qw5h-7f53-xrp6
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2021-29615'
  - url: >-
      https://github.com/tensorflow/tensorflow/commit/e07e1c3d26492c06f078c7e5bf2d138043e199c1
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-543.yaml
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-741.yaml
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-252.yaml
  - url: 'https://github.com/tensorflow/tensorflow'
tags:
  - osv
  - pip
epss: 0.00204
epssPercentile: 0.0913
ingestedAt: '2026-09-12T03:13:01.723Z'
---

## Overview

### Impact
The implementation of [`ParseAttrValue`](https://github.com/tensorflow/tensorflow/blob/c22d88d6ff33031aa113e48aa3fc9aa74ed79595/tensorflow/core/framework/attr_value_util.cc#L397-L453) can be tricked into stack overflow due to recursion by giving in a specially crafted input.

### Patches
We have patched the issue in GitHub commit [e07e1c3d26492c06f078c7e5bf2d138043e199c1](https://github.com/tensorflow/tensorflow/commit/e07e1c3d26492c06f078c7e5bf2d138043e199c1).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

## Affected packages

- `tensorflow < 2.1.4`
- `tensorflow >= 2.2.0, < 2.2.3`
- `tensorflow >= 2.3.0, < 2.3.3`
- `tensorflow >= 2.4.0, < 2.4.2`
- `tensorflow-cpu < 2.1.4`
- `tensorflow-cpu >= 2.2.0, < 2.2.3`
- `tensorflow-cpu >= 2.3.0, < 2.3.3`
- `tensorflow-cpu >= 2.4.0, < 2.4.2`
- `tensorflow-gpu < 2.1.4`
- `tensorflow-gpu >= 2.2.0, < 2.2.3`
- `tensorflow-gpu >= 2.3.0, < 2.3.3`
- `tensorflow-gpu >= 2.4.0, < 2.4.2`

## Remediation

Upgrade to a patched release:

- `tensorflow 2.1.4`
- `tensorflow 2.2.3`
- `tensorflow 2.3.3`
- `tensorflow 2.4.2`
- `tensorflow-cpu 2.1.4`
- `tensorflow-cpu 2.2.3`
- `tensorflow-cpu 2.3.3`
- `tensorflow-cpu 2.4.2`
- `tensorflow-gpu 2.1.4`
- `tensorflow-gpu 2.2.3`
- `tensorflow-gpu 2.3.3`
- `tensorflow-gpu 2.4.2`