{"id":"CVE-2026-115920","kind":"vulnerability","aliases":["CVE-2026-115920"],"related":[],"title":"ONNX: malformed ConvTranspose model crashes shape inference, denial of service","description":"Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. From 1.2.1 until 1.22.0, ConvTranspose shape inference processes a weight tensor with fewer than three dimensions without a kernel_shape attribute by deriving an empty effective_kernel_shape and indexing it for the input's spatial dimensions. The flaw affects convTransposeShapeInference_opset11() and the current inference path, and an untrusted model that can pass onnx.checker.check_model() can crash onnx.shape_inference.infer_shapes(), causing denial of service without demonstrated confidentiality or integrity impact. This issue is fixed in version 1.22.0.","summary":"A crafted ONNX model with a ConvTranspose weight tensor of fewer than three dimensions and no kernel_shape attribute makes shape inference index an empty array and crash. An attacker who can supply a model that passes onnx.checker.check_model() can crash any process running onnx.shape_inference.infer_shapes().","severity":"medium","cvss":6.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["machine-learning","onnx","package","python"],"not_affected_if":["onnx-below-1.2.1","trusted-models-only"],"how_to_check":"- Run `python -c \"import onnx; print(onnx.__version__)\"` and check whether the result is below `1.22.0`\n- Search your code for calls to `infer_shapes` on models from untrusted sources","fix":"- Upgrade the `onnx` Python package to `1.22.0` or later\n- Validate or reject models from untrusted sources before running shape inference","status":"open","published_at":"2026-10-26T18:17:39+00:00","first_seen_at":"2026-10-26T18:31:43+00:00","triaged_at":"2026-10-26T18:34:07+00:00","updated_at":"2026-10-26T18:34:07+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-26T18:34:07Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the `onnx` Python package to `1.22.0` or later\n- Validate or reject models from untrusted sources before running shape inference","reach":"unknown","title":"ONNX: malformed ConvTranspose model crashes shape inference, denial of service","impact":"low","summary":"A crafted ONNX model with a ConvTranspose weight tensor of fewer than three dimensions and no kernel_shape attribute makes shape inference index an empty array and crash. An attacker who can supply a model that passes onnx.checker.check_model() can crash any process running onnx.shape_inference.infer_shapes().","category":"package","nicknames":[],"who_cares":["python","onnx","machine-learning"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Process crashes during shape inference, causing denial of service","analyst_note":"","how_to_check":"- Run `python -c \"import onnx; print(onnx.__version__)\"` and check whether the result is below `1.22.0`\n- Search your code for calls to `infer_shapes` on models from untrusted sources","needs_analyst":false,"not_affected_if":["trusted-models-only","onnx-below-1.2.1"],"who_is_affected":"Teams that load ONNX models supplied from outside their own trust boundary and run shape inference on them, for example a service that accepts user-uploaded models. Services that only load models they built or vetted themselves are much less exposed, and the crash is a denial of service with no demonstrated data access.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000619,"input_tokens":3443,"output_tokens":549,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115920':13A,16A '-2026':12A,15A '1.2.1':83C '1.22.0':85C,158C 'affect':121C 'array':48B 'attack':52B 'attribut':41B,102C 'caus':142C 'confidenti':148C 'convtranspos':3A,29B,86C 'convtransposeshapeinfer':122C 'craft':24B 'crash':5A,50B,63B,139C 'current':126C 'cve':11A,14A 'demonstr':147C 'denial':8A,143C 'deriv':104C 'dimens':36B,97C,118C 'effect':107C 'empti':47B,106C 'exchang':72C 'fewer':33B,94C 'fix':155C 'flaw':120C 'impact':151C 'index':45B,111C 'infer':7A,44B,88C,127C 'input':115C 'integr':150C 'interoper':81C 'issu':153C 'kernel':39B,100C,108C 'learn':19B,80C 'machin':18B,79C 'machine-learn':17B 'make':42B 'malform':2A 'model':4A,26B,57B,61B,132C,137C 'network':71C 'neural':70C 'onnx':1A,20B,25B,73C 'onnx.checker.check':60B,136C 'onnx.shape_inference.infer':67B,140C 'open':69C,76C 'opset11':123C 'packag':21B 'pass':59B,135C 'path':128C 'process':65B,89C 'python':22B 'run':66B 'servic':10A,145C 'shape':6A,40B,43B,68B,87C,101C,109C,141C 'spatial':117C 'standard':77C 'suppli':55B 'tensor':31B,92C 'three':35B,96C 'untrust':131C 'version':157C 'weight':30B,91C 'without':98C,146C","nicknames":[],"mitigations":[],"who_affected":"Teams that load ONNX models supplied from outside their own trust boundary and run shape inference on them, for example a service that accepts user-uploaded models. Services that only load models they built or vetted themselves are much less exposed, and the crash is a denial of service with no demonstrated data access.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T18:17:39+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115920","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115920","severity":null,"published_at":"2026-10-26T18:17:39+00:00","modified_at":"2026-10-26T18:17:39+00:00","first_seen_at":"2026-10-26T18:31:43+00:00","fetched_at":"2026-10-26T18:31:43+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}