{"id":"CVE-2026-115922","kind":"vulnerability","aliases":["CVE-2026-115922"],"related":[],"title":"ONNX: crafted tensor shape exhausts memory during to_array conversion","description":"Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to 1.22.0, _unpack_2bit() and _unpack_4bit() resize unpacked arrays according to attacker-controlled TensorProto.dims without verifying that raw_data or int32_data encodes the declared number of elements. Materializing an untrusted UINT2, INT2, UINT4, INT4, or FLOAT4E2M1 tensor through onnx.numpy_helper.to_array() or onnx.reference.ReferenceEvaluator can therefore expand a small packed payload into a disproportionately large allocation and exhaust memory. This issue is fixed in version 1.22.0.","summary":"ONNX's 2-bit and 4-bit tensor unpacking trusts attacker-controlled tensor dimensions and allocates memory to match them without checking the packed payload size. Loading an untrusted model with these tensor types through onnx.numpy_helper.to_array() or ReferenceEvaluator can exhaust the memory of the process, causing a denial of service.","severity":"medium","cvss":6.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["machine-learning","onnx","package","python"],"not_affected_if":["no-untrusted-model-input","trusted-models-only"],"how_to_check":"- Run `pip show onnx` and check whether the installed version is below `1.22.0`\n- Check whether the application loads untrusted ONNX models with `onnx.numpy_helper.to_array()` or `onnx.reference.ReferenceEvaluator`","fix":"- Upgrade the onnx package to `1.22.0` or later\n- Until upgraded, only load ONNX models from trusted sources","status":"open","published_at":"2026-10-26T18:17:40+00:00","first_seen_at":"2026-10-26T18:31:43+00:00","triaged_at":"2026-10-26T18:34:04+00:00","updated_at":"2026-10-26T18:34:04+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-26T18:34:04Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the onnx package to `1.22.0` or later\n- Until upgraded, only load ONNX models from trusted sources","reach":"unknown","title":"ONNX: crafted tensor shape exhausts memory during to_array conversion","impact":"low","summary":"ONNX's 2-bit and 4-bit tensor unpacking trusts attacker-controlled tensor dimensions and allocates memory to match them without checking the packed payload size. Loading an untrusted model with these tensor types through onnx.numpy_helper.to_array() or ReferenceEvaluator can exhaust the memory of the process, causing a denial of service.","category":"package","nicknames":[],"who_cares":["python","onnx","machine-learning"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Crafted model exhausts server memory, causing denial of service","analyst_note":"","how_to_check":"- Run `pip show onnx` and check whether the installed version is below `1.22.0`\n- Check whether the application loads untrusted ONNX models with `onnx.numpy_helper.to_array()` or `onnx.reference.ReferenceEvaluator`","needs_analyst":false,"not_affected_if":["trusted-models-only","no-untrusted-model-input"],"who_is_affected":"Applications that accept ONNX models from untrusted users or external sources and materialize tensors of type UINT2, INT2, UINT4, INT4 or FLOAT4E2M1 with the onnx Python package. Systems that only load models they produced or vetted themselves are much less exposed. Teams that never parse external models can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000641,"input_tokens":3447,"output_tokens":593,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115922':13A,16A '-2026':12A,15A '1.22.0':90C,155C '2':25B '2bit':92C '4':28B '4bit':95C 'accord':99C 'alloc':39B,145C 'array':9A,60B,98C,131C 'attack':34B,102C 'attacker-control':33B,101C 'bit':26B,29B 'caus':70B 'check':45B 'control':35B,103C 'convers':10A 'craft':2A 'cve':11A,14A 'data':109C,112C 'declar':115C 'denial':72B 'dimens':37B 'disproportion':143C 'element':118C 'encod':113C 'exchang':78C 'exhaust':5A,64B,147C 'expand':136C 'fix':152C 'float4e2m1':127C 'int2':123C 'int32':111C 'int4':125C 'interoper':87C 'issu':150C 'larg':144C 'learn':19B,86C 'load':50B 'machin':18B,85C 'machine-learn':17B 'match':42B 'materi':119C 'memori':6A,40B,66B,148C 'model':53B 'network':77C 'neural':76C 'number':116C 'onnx':1A,20B,23B,79C 'onnx.numpy_helper.to':59B,130C 'onnx.reference.referenceevaluator':133C 'open':75C,82C 'pack':47B,139C 'packag':21B 'payload':48B,140C 'prior':88C 'process':69B 'python':22B 'raw':108C 'referenceevalu':62B 'resiz':96C 'servic':74B 'shape':4A 'size':49B 'small':138C 'standard':83C 'tensor':3A,30B,36B,56B,128C 'tensorproto.dims':104C 'therefor':135C 'trust':32B 'type':57B 'uint2':122C 'uint4':124C 'unpack':31B,91C,94C,97C 'untrust':52B,121C 'verifi':106C 'version':154C 'without':44B,105C","nicknames":[],"mitigations":[],"who_affected":"Applications that accept ONNX models from untrusted users or external sources and materialize tensors of type UINT2, INT2, UINT4, INT4 or FLOAT4E2M1 with the onnx Python package. Systems that only load models they produced or vetted themselves are much less exposed. Teams that never parse external models can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T18:17:40+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115922","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115922","severity":null,"published_at":"2026-10-26T18:17:40+00:00","modified_at":"2026-10-26T18:17:40+00:00","first_seen_at":"2026-10-26T18:31:43+00:00","fetched_at":"2026-10-26T18:31:43+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}