Live › vulnerability › CVE-2026-115920
Go to dashboardA crafted ONNX model with a ConvTranspose weight tensor of fewer than three dimensions and no kernel_shape attribute makes shape inference index an empty array and crash. An attacker who can supply a model that passes onnx.checker.check_model() can crash any process running onnx.shape_inference.infer_shapes().
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 18:31 UTC. All times on this page are UTC.
Teams that load ONNX models supplied from outside their own trust boundary and run shape inference on them, for example a service that accepts user-uploaded models. Services that only load models they built or vetted themselves are much less exposed, and the crash is a denial of service with no demonstrated data access.
No product ranges from the sources yet.
python -c "import onnx; print(onnx.__version__)" and check whether the result is below 1.22.0infer_shapes on models from untrusted sourcesonnx Python package to 1.22.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. From 1.2.1 until 1.22.0, ConvTranspose shape inference processes a weight tensor with fewer than three dimensions without a kernel_shape attribute by deriving an empty effective_kernel_shape and indexing it for the input's spatial dimensions. The flaw affects convTransposeShapeInference_opset11() and the current inference path, and an untrusted model that can pass onnx.checker.check_model() can crash onnx.shape_inference.infer_shapes(), causing denial of service without demonstrated confidentiality or integrity impact. This issue is fixed in version 1.22.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-115920")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.