Stack exhaustion in TensorFlow Serving JSON parsing (CVE-2025-0649)
TensorFlow Serving contained a stack exhaustion vulnerability (CVE-2025-0649) triggered by large JSON requests. The vulnerability was fixed by implementing bounds checking and a limited-size JSON writer.
What happened
TensorFlow Serving had a vulnerability (CVE-2025-0649) related to stack exhaustion when handling large JSON requests.
The vulnerability was addressed by improving the handling of large JSON requests in the json_tensor.cc component, including implementation of a JsonWriterWithLimit class to enforce a maximum byte size on JSON output.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.