tensorflow / tensorflow/serving
Vulnerability in Libgcrypt CVE-2026-41989
Open
@jeelania10 is already working on this.
Since Aug 12, 2026.
stat:awaiting tensorflower
type:support
- Dominant language
- C++
- Stars
- 6.4k
- Forks
- 2.2k
- PR merge metrics
- No merged PRs in 30d
Description
Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext to gcry_pk_decrypt.
It is transitive dependency from Ubuntu base image.
https://github.com/tensorflow/serving/blob/master/tensorflow_serving/tools/docker/Dockerfile#L19
https://hub.docker.com/layers/library/ubuntu/22.04/images/sha256-ffa841e85005182836d91f7abd24ec081f3910716096955dcc1874b8017b96c9?context=explore
Remove the library if it is not called by Tensorflow or upgrade the Ubuntu base image where that vulnerability does not exist.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.