Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

TensorFlow 2.16.1-11 can crash when handling HTTP/2 requests

published 27 days ago

Summary

TensorFlow’s built‑in HTTP/2 server may stop working if a client repeatedly sends requests while changing a setting that controls header storage. This can cause the server to crash, interrupting services that rely on TensorFlow. Apply the latest TensorFlow update or disable HTTP/2 handling until a fix is available.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Ecosystem	Vendor	Product	Affected versions
Azure Linux:3	azure	tensorflow	<= 2.16.1-11

Original advisory text

CVE-2026-97032 affecting package tensorflow 2.16.1-11

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-97032 URL

Timeline

Published8 Oct 2026

Updated17 Oct 2026

First seen17 Oct 2026

Sources

AZL-108549 · OSV

Track software like this

Free during beta