CVE-2026-115922: ONNX: Denial of service via unchecked expansion of packed sub-byte tensors in ONNX Python APIs
ONNX’s Python tensor-materialization helpers could allocate memory according to attacker-controlled tensor dimensions without verifying that a packed sub-byte payload contained the declared number of elements.
A very small model could therefore cause a disproportionately large allocation when an application called onnx.numpy_helper.to_array() or constructed onnx.reference.ReferenceEvaluator with the model. The issue affected UINT2, INT2, UINT4, INT4, and FLOAT4E2M1 tensors stored in either raw_data or packed int32_data.
References
- github.com/advisories/GHSA-q69g-f4f5-v8m7
- github.com/onnx/onnx/commit/05c1bc3bceceb8d3cf11e9e7fc7f19f971c44988
- github.com/onnx/onnx/commit/8de2cf6aa47928e6515ac6d9e1a8b4758886a7df
- github.com/onnx/onnx/commit/dce5876d6cc6cc30157af7d26a752ef44976da8e
- github.com/onnx/onnx/pull/8033
- github.com/onnx/onnx/pull/8038
- github.com/onnx/onnx/pull/8066
- github.com/onnx/onnx/releases/tag/v1.22.0
- github.com/onnx/onnx/security/advisories/GHSA-q69g-f4f5-v8m7
- nvd.nist.gov/vuln/detail/CVE-2026-115922
Code Behaviors & Features
Detect and mitigate CVE-2026-115922 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →