Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-115922 · GHSA-q69g-f4f5-v8m7

ONNX: Denial of service via unchecked expansion of packed sub-byte tensors in ONNX Python APIs

Risk score
48/100
CVSS
6.2 v3.1
Exploit chance (30 days)
0.1%
Published
26 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to 1.22.0, _unpack_2bit() and _unpack_4bit() resize unpacked arrays according to attacker-controlled TensorProto.dims without verifying that raw_data or int32_data encodes the declared number of elements. Materializing…
Affected
onnx (pip) <= 1.21.0
Fix
Upgrade onnx to 1.22.0 or later.
Exploitation
No known exploitation

Story map

Story map: onnxTHE FLAWSTHE FIXCVE-2026-115922ONNX: Denial of service viaunchecked expansion of packedsub-byte tensors in ONNX…CVSS 6.2 · EPSS 0%CVE-2026-115919ONNX: Out-of-Bounds Read inRNN/GRU/LSTM ShapeInference (Old Opsets…CVSS 6.2 · EPSS 0%CVE-2026-115920ONNX: Out-of-bounds read inConvTranspose shape inferencevia undersized weight rankCVSS 6.2 · EPSS 0%CVE-2026-115921ONNX: Null Pointer Dereferencein ScanInferenceFunction Dueto Missing Required AttributeCVSS 6.2 · EPSS 0%Upgrade onnx1.22.0or later on your release lineWho is exposedonnx (pip) <= 1.21.0YELLOW · PLAN IT INonnxOpen Neural Network Exchange(ONNX) is an open standard formachine learninginteroperability. Prior to 1.22.0,_unpack_2bit() and_unpack_4bit() resize unpackedarrays according to…Where it standsNo known exploitationCONNECTS TOSame weaknessCWE-789 (CWE-789)54 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

onnx: Yellow, plan it in. Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to 1.22.0, _unpack_2bit() and _unpack_4bit() resize unpacked arrays according to attacker-controlled TensorProto.dims without verifying that raw_data or int32_data encodes the declared number of elements. Materializing…

The flaws

  • CVE-2026-115922: ONNX: Denial of service via unchecked expansion of packed sub-byte tensors in ONNX Python APIs (CVSS 6.2 · EPSS 0%)
  • CVE-2026-115919: ONNX: Out-of-Bounds Read in RNN/GRU/LSTM Shape Inference (Old Opsets, Missing Rank Check) (CVSS 6.2 · EPSS 0%)
  • CVE-2026-115920: ONNX: Out-of-bounds read in ConvTranspose shape inference via undersized weight rank (CVSS 6.2 · EPSS 0%)
  • CVE-2026-115921: ONNX: Null Pointer Dereference in ScanInferenceFunction Due to Missing Required Attribute (CVSS 6.2 · EPSS 0%)

The fix

Upgrade onnx: 1.22.0 or later on your release line

Who is exposed: onnx (pip) <= 1.21.0

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 6.2 medium
  • On your watchlist: python, PyPI

Affected packages

PackageEcosystemVulnerableFixed in
onnxpip<= 1.21.01.22.0

References

Original description

Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to 1.22.0, _unpack_2bit() and _unpack_4bit() resize unpacked arrays according to attacker-controlled TensorProto.dims without verifying that raw_data or int32_data encodes the declared number of elements. Materializing an untrusted UINT2, INT2, UINT4, INT4, or FLOAT4E2M1 tensor through onnx.numpy_helper.to_array() or onnx.reference.ReferenceEvaluator can therefore expand a small packed payload into a disproportionately large allocation and exhaust memory. This issue is fixed in version 1.22.0.

Last activity 28 Oct 2026. Patch Forecast updates every hour.