CVE-2025-55559 — HIGH (CVSS 7.5) AI Security Vulnerability

CISO Take

Any TensorFlow 2.18.0 inference service accepting external input through Conv2D layers with 'valid' padding can be remotely crashed with no authentication required. Prioritize patching or isolating exposed model serving endpoints. If patching is not immediately possible, enforce strict input validation at the API boundary to reject malformed tensor shapes.

Risk Assessment

HIGH. CVSS 7.5 with network vector, low complexity, no privileges, no user interaction makes this trivially exploitable at scale. The blast radius is significant given TensorFlow's ubiquity in production ML pipelines. While exploitation only achieves availability impact (no data exfiltration), a sustained DoS against an inference endpoint can disrupt AI-dependent business processes, trigger SLA violations, and create windows for secondary attacks during incident response chaos.

Affected Systems

Package	Ecosystem	Vulnerable Range	Patched
tensorflow	pip	—	No patch
195.0K OpenSSF 7.2 3.7K dependents Pushed today 4% patched ~1372d to patch Full package profile →

Do you use tensorflow? You're affected.

Severity & Risk

CVSS 3.1

7.5 / 10

EPSS

0.1%

chance of exploitation in 30 days

Higher than 19% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, CISA SSVC, EPSS, trickest/cve, and Nuclei templates.

Attack Surface

AV Network

AC Low

PR None

UI None

S Unchanged

C None

I None

A High

Recommended Action

5 steps

PATCH

Upgrade TensorFlow beyond 2.18.0 as soon as a fixed release is available; monitor the TensorFlow GitHub releases page and security advisories.
WORKAROUND

Add input validation middleware that enforces allowlisted padding values and valid tensor shape ranges before passing data to Conv2D layers.
NETWORK

Place TF Serving instances behind API gateways with rate limiting and request size limits to reduce DoS feasibility.
DETECTION

Alert on anomalous inference endpoint crash rates or sudden process restarts in TF Serving containers.
ISOLATION

If the model endpoint is not customer-facing, restrict network access to internal clients only via VPC/firewall rules immediately.

CISA SSVC Assessment

Decision Track*

Exploitation poc

Automatable Yes

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

Classification

DoS Framework Inference AML.T0029 - Denial of AI Service AML.T0034 - Cost Harvesting AML.T0049 - Exploit Public-Facing Application

Compliance Impact

This CVE is relevant to:

EU AI Act

Art. 15 - Accuracy, robustness and cybersecurity Art. 9 - Risk management system

ISO 42001

6.1.2 - AI risk assessment 8.4 - AI system operation

NIST AI RMF

MANAGE-2.2 - Mechanisms to respond to AI risks

Frequently Asked Questions

What is CVE-2025-55559?

Any TensorFlow 2.18.0 inference service accepting external input through Conv2D layers with 'valid' padding can be remotely crashed with no authentication required. Prioritize patching or isolating exposed model serving endpoints. If patching is not immediately possible, enforce strict input validation at the API boundary to reject malformed tensor shapes.

Is CVE-2025-55559 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2025-55559, increasing the risk of exploitation.

How to fix CVE-2025-55559?

1. PATCH: Upgrade TensorFlow beyond 2.18.0 as soon as a fixed release is available; monitor the TensorFlow GitHub releases page and security advisories. 2. WORKAROUND: Add input validation middleware that enforces allowlisted padding values and valid tensor shape ranges before passing data to Conv2D layers. 3. NETWORK: Place TF Serving instances behind API gateways with rate limiting and request size limits to reduce DoS feasibility. 4. DETECTION: Alert on anomalous inference endpoint crash rates or sudden process restarts in TF Serving containers. 5. ISOLATION: If the model endpoint is not customer-facing, restrict network access to internal clients only via VPC/firewall rules immediately.

What systems are affected by CVE-2025-55559?

This vulnerability affects the following AI/ML architecture patterns: model serving, training pipelines, inference APIs, image processing pipelines.

What is the CVSS score for CVE-2025-55559?

CVE-2025-55559 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.06%.

Technical Details

NVD Description

An issue was discovered TensorFlow v2.18.0. A Denial of Service (DoS) occurs when padding is set to 'valid' in tf.keras.layers.Conv2D.

Exploitation Scenario

An adversary identifies a public-facing image classification API (e.g., a product photo moderation service) running TensorFlow 2.18.0. By inspecting API responses or documentation, they confirm the backend uses a CNN architecture. The adversary crafts a lightweight HTTP client that sends valid-looking image inference requests specifically designed to trigger the Conv2D 'valid' padding bug — this requires no special ML knowledge, just the right input shape or configuration. Repeated requests crash the TensorFlow process, taking down the inference service. If the service auto-restarts, the adversary loops the attack for sustained disruption. At scale, this can be used to eliminate AI-based fraud detection or content moderation layers before a larger attack.