CVE-2025-0649

Stack Exhaustion In Tensorflow Serving

State: Published
Severity: 8.9 High
Published: May 6, 2025
Updated: May 6, 2025
Reserved: Jan 22, 2025

Description

Incorrect JSON input stringification in Google's Tensorflow serving versions up to 2.18.0 allows for potentially unbounded recursion leading to server crash.

Scores

CVSS	Score	Vector	Source
4.0	8.9 High	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H	Google

Weaknesses

CWE-121

Affected Products

Product	Versions
TensorflowGoogle	2.18.0 and earlierAffected

References

https://github.com/tensorflow/serving/commit/6cb013167d13f2ed3930aabb86dbc2c8c53f5adf

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.