CVE-2025-55559: 
TensorFlow vulnerability analysis and mitigation

CVE-2025-55559 is a Denial of Service (DoS) vulnerability in TensorFlow v2.18.0 that occurs when the padding='valid' parameter is used in tf.keras.layers.Conv2D and the model is compiled with XLA (JIT compilation). The vulnerability was reported by researcher shaoyuyoung and published on September 25, 2025. It affects TensorFlow version 2.18.0 and has a CVSS v3.1 base score of 7.5 (High) (GitHub Issue, Feedly).

The root cause is a runtime error (CWE-400: Uncontrolled Resource Consumption) triggered when XLA attempts to compile a tf.keras.layers.Conv2D layer configured with padding='valid' and an input spatial dimension smaller than the kernel size. Specifically, XLA fails to handle the resulting negative dimension size (e.g., subtracting a kernel size of 4 from an input dimension of 3), throwing a fatal error: Negative dimension size caused by subtracting 4 from 3. Notably, the same configuration succeeds in eager execution mode, revealing a misalignment between eager and XLA compilation paths. An attacker can trigger this by supplying a crafted model or input configuration that causes XLA to encounter this invalid convolution geometry (GitHub Issue, CVE Gist).

Successful exploitation causes a runtime crash in the TensorFlow process when XLA compilation is enabled (jit_compile=True), resulting in a complete loss of availability for the affected service. There is no confidentiality or integrity impact. Systems serving TensorFlow-based inference or training pipelines with XLA-compiled Conv2D layers using padding='valid' are at risk of service disruption if an attacker can influence model configuration or input parameters (GitHub Issue, Feedly).

1. Identify target: Locate a TensorFlow v2.18.0 deployment that uses XLA JIT compilation (@tf.function(jit_compile=True)) and accepts user-influenced model configurations or inputs.
2. Craft malicious model configuration: Construct or influence a tf.keras.layers.Conv2D layer with padding='valid' and a kernel size larger than the spatial dimensions of the input tensor (e.g., kernel_size=4 with a 3×3 input).
3. Trigger XLA compilation: Invoke the model with jit_compile=True so that XLA attempts to compile the Conv2D operation with the invalid geometry.
4. Achieve DoS: XLA raises a fatal runtime error (Negative dimension size caused by subtracting 4 from 3), crashing the TensorFlow process and causing a denial of service (GitHub Issue, CVE Gist).

• Logs: TensorFlow process logs containing the error message Negative dimension size caused by subtracting [kernel_size] from [input_dim] associated with a Conv2D XLA compilation node.
• Logs: Stack traces referencing conv2d/convolution = Conv2D[...padding="VALID"...] with mismatched input and kernel shapes.
• Process: Unexpected termination or crash of the TensorFlow serving or training process, particularly when jit_compile=True is active.
• Network: Repeated requests to a model serving endpoint that result in process restarts or 5xx errors, potentially indicating automated crash-triggering attempts (GitHub Issue).

No official patch from Google/TensorFlow has been publicly announced for this specific CVE as of the time of writing. As a workaround, avoid using padding='valid' in tf.keras.layers.Conv2D when XLA JIT compilation (jit_compile=True) is enabled, or ensure that input spatial dimensions are always larger than the kernel size. Users should consider upgrading to a newer TensorFlow version if a fix becomes available, or disabling XLA compilation for affected model components. Network-level restrictions limiting who can submit model configurations or inputs to TensorFlow services can reduce exposure (CVE Gist, GitHub Issue).

The TensorFlow community confirmed the vulnerability via the GitHub issue tracker, where it was labeled as a bug affecting TF 2.18 and the XLA compiler component. The issue was marked as awaiting response from the author and later labeled stale, suggesting limited active engagement from the TensorFlow maintainers. No significant media coverage or notable researcher commentary beyond the original reporter (shaoyuyoung) has been identified (GitHub Issue).