Google · Tensorflow · CVE-2021-41225
**Name of the Vulnerable Software and Affected Versions**
TensorFlow versions prior to 2.7.0
TensorFlow version 2.6.1
TensorFlow version 2.5.2
TensorFlow version 2.4.4
**Description**
TensorFlow's Grappler optimizer has a use of an uninitialized variable. If the `train nodes` vector does not contain a `Dequeue` node, then `dequeue node` is left uninitialized.
**Recommendations**
For TensorFlow versions prior to 2.7.0, update to version 2.7.0 or later.
For TensorFlow version 2.6.1, update to a version that includes the cherrypicked commit.
For TensorFlow version 2.5.2, update to a version that includes the cherrypicked commit.
For TensorFlow version 2.4.4, update to a version that includes the cherrypicked commit.
As a temporary workaround, consider disabling the Grappler optimizer until a patch is available.