Google TensorFlow Serving Unbounded Recursion Vulnerability Allowing Denial-of-Service

A denial-of-service vulnerability has been identified in Google TensorFlow Serving, affecting versions prior to 2.18.0. The issue arises from incorrect handling of large JSON input strings, which can lead to potentially unbounded recursion and cause the server to crash.

Impact

Exploitation of this vulnerability can lead to a server crash, causing a denial-of-service condition.

Reproduction

The vulnerability can be reproduced by sending a JSON request that includes a deeply nested structure or a large array. For example, a request can be crafted with the 'instances' key containing a large array, which will trigger the unbounded recursion when the server processes the JSON.

Remediation

Users can upgrade to TensorFlow Serving version 2.19.0 or later, where this vulnerability has been addressed.