{"id":"CVE-2026-115921","kind":"vulnerability","aliases":["CVE-2026-115921"],"related":[],"title":"ONNX: malformed Scan model crashes shape inference via unchecked attribute","description":"Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. From 1.4.0 until 1.22.0, ScanInferenceFunction, ScanInferenceFunction_opset8, and ScanInferenceFunction_opset9 do not safely validate the required num_scan_inputs attribute. A missing attribute is dereferenced as a null pointer, while a negative value is converted to size_t and can reach an exceptional oversized allocation path. An untrusted model can therefore terminate or disrupt shape inference, including a negative-value model that can pass onnx.checker.check_model(). This issue is fixed in version 1.22.0.","summary":"ONNX, an open machine learning model format library, mishandles the num_scan_inputs attribute in its Scan inference functions. A crafted model with that attribute missing or negative can crash or disrupt shape inference when loaded.","severity":"medium","cvss":6.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["machine-learning","onnx","package","python"],"not_affected_if":["trusted-models-only"],"how_to_check":"- Check the installed ONNX version with `python -c \"import onnx; print(onnx.__version__)\"`; versions from `1.4.0` up to but not including `1.22.0` are affected\n- Look for model loading of untrusted ONNX files in your pipelines and services","fix":"- Upgrade the onnx package to `1.22.0` or later\n- Only load ONNX models from trusted sources until upgraded","status":"open","published_at":"2026-10-26T18:17:39+00:00","first_seen_at":"2026-10-26T18:31:43+00:00","triaged_at":"2026-10-26T18:34:05+00:00","updated_at":"2026-10-26T18:34:05+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-26T18:34:05Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the onnx package to `1.22.0` or later\n- Only load ONNX models from trusted sources until upgraded","reach":"network","title":"ONNX: malformed Scan model crashes shape inference via unchecked attribute","impact":"low","summary":"ONNX, an open machine learning model format library, mishandles the num_scan_inputs attribute in its Scan inference functions. A crafted model with that attribute missing or negative can crash or disrupt shape inference when loaded.","category":"package","nicknames":[],"who_cares":["python","machine-learning","onnx"],"confidence":0.7,"needs_auth":"no","worst_case":"Model loading or shape inference crashes, disrupting the service","analyst_note":"","how_to_check":"- Check the installed ONNX version with `python -c \"import onnx; print(onnx.__version__)\"`; versions from `1.4.0` up to but not including `1.22.0` are affected\n- Look for model loading of untrusted ONNX files in your pipelines and services","needs_analyst":false,"not_affected_if":["trusted-models-only"],"who_is_affected":"Applications that load or run ONNX models supplied from outside the team, such as user uploads or third-party model files, are exposed to a denial-of-service crash. Teams that only load their own trusted models, or that do not use ONNX, can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000595,"input_tokens":3431,"output_tokens":503,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115921':13A,16A '-2026':12A,15A '1.22.0':75C,145C '1.4.0':73C 'alloc':116C 'attribut':10A,36B,47B,91C,94C 'convert':106C 'craft':43B 'crash':5A,52B 'cve':11A,14A 'dereferenc':96C 'disrupt':54B,125C 'except':114C 'exchang':62C 'fix':142C 'format':29B 'function':41B 'includ':128C 'infer':7A,40B,56B,127C 'input':35B,90C 'interoper':71C 'issu':140C 'learn':19B,27B,70C 'librari':30B 'load':58B 'machin':18B,26B,69C 'machine-learn':17B 'malform':2A 'mishandl':31B 'miss':48B,93C 'model':4A,28B,44B,120C,133C,138C 'negat':50B,103C,131C 'negative-valu':130C 'network':61C 'neural':60C 'null':99C 'num':33B,88C 'onnx':1A,20B,23B,63C 'onnx.checker.check':137C 'open':25B,59C,66C 'opset8':78C 'opset9':81C 'overs':115C 'packag':21B 'pass':136C 'path':117C 'pointer':100C 'python':22B 'reach':112C 'requir':87C 'safe':84C 'scan':3A,34B,39B,89C 'scaninferencefunct':76C,77C,80C 'shape':6A,55B,126C 'size':108C 'standard':67C 'termin':123C 'therefor':122C 'uncheck':9A 'untrust':119C 'valid':85C 'valu':104C,132C 'version':144C 'via':8A","nicknames":[],"mitigations":[],"who_affected":"Applications that load or run ONNX models supplied from outside the team, such as user uploads or third-party model files, are exposed to a denial-of-service crash. Teams that only load their own trusted models, or that do not use ONNX, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T18:17:39+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115921","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115921","severity":null,"published_at":"2026-10-26T18:17:39+00:00","modified_at":"2026-10-26T18:17:39+00:00","first_seen_at":"2026-10-26T18:31:43+00:00","fetched_at":"2026-10-26T18:31:43+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}