PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-108958 TensorLayer CVE debrief

A weakness in TensorLayer's HDF5 loading functionality can lead to deserialization issues, affecting versions up to 2.2.4. The attack can be executed remotely. The project was informed early but has not responded yet. This issue requires defenders to assess exposure and prioritize verification of affected versions, considering potential deserialization issues and the need for remediation. The CVE record and source item provide details, but specific exploitation and impact details are limited.

Vendor
TensorLayer
Product
TensorLayer
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-13
Original CVE updated
2026-10-13
Advisory published
2026-10-13
Advisory updated
2026-10-13

Who should care

Defenders of systems using TensorLayer versions up to 2.2.4 should assess exposure and prioritize verification of affected versions. This includes reviewing potential deserialization issues and the need for remediation. The vulnerability's impact on operational security and potential exploitation requires immediate attention from defenders to ensure system security and integrity.

Why it matters

A weakness in TensorLayer's HDF5 loading functionality can lead to deserialization issues, affecting versions up to 2.2.4. Defenders should assess exposure and prioritize verification.

  • Potential deserialization issues require verification
  • Exposure of affected TensorLayer versions needs assessment
  • Remediation priority is unknown due to limited information

Technical summary

The load_hdf5_graph function in tensorlayer/files/utils.py is vulnerable to deserialization issues due to manipulation of the model_config argument. This affects TensorLayer versions up to 2.2.4. The vulnerability allows for remote execution and requires defenders to assess exposure and prioritize verification. The technical details of the vulnerability are based on the provided CVE record and source item, which may lack specific information on exploitation and impact. Defenders should focus on verifying affected versions and monitoring for potential issues.

Defensive priority

Assess exposure and prioritize verification of affected versions

Recommended defensive actions

  • Assess exposure of TensorLayer versions up to 2.2.4
  • Prioritize verification of affected versions
  • Monitor for potential deserialization issues
  • Review compensating controls for exposed systems
  • Check relevant monitoring, detection, and logs for exposed assets
  • Track exceptions and retest remediated assets
  • Confirm whether affected product deployments exist in managed environments

Evidence notes

The CVE record and source item provide details on the weakness in TensorLayer's HDF5 loading functionality. However, the corpus lacks specific details on exploitation, impact, and remediation. Defenders should verify affected versions and monitor for potential deserialization issues. The project was informed early, but no response has been received yet. Limited information is available on the exploitability and potential impact of this vulnerability.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-108958 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-108958

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-108958 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-108958

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • TensorLayer HDF5 Loading utils.py load_hdf5_graph deserialization

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108958.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://vuldb.com/vuln/416777

    Supplemental source - vdb-entry, technical-description

  • Source reference

    Unverified legacy reference

    URL: https://vuldb.com/vuln/416777/cti

    Supplemental source - signature, permissions-required

  • Source reference

    Unverified legacy reference

    URL: https://vuldb.com/cve/CVE-2026-108958

    Supplemental source - third-party-advisory

  • Source reference

    Unverified legacy reference

    URL: https://vuldb.com/submit/997885

    Supplemental source - third-party-advisory

  • Source reference

    Unverified legacy reference

    URL: https://github.com/tensorlayer/TensorLayer/issues/1169

    Supplemental source - exploit, issue-tracking

  • Source reference

    Unverified legacy reference

    URL: https://github.com/tensorlayer/TensorLayer/

    Supplemental source - product

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.