Vulnerabilities

Vulnerability · CVE-2026-115922

ONNX: Denial of service via unchecked expansion of packed sub-byte tensors in ONNX Python APIs

Published Oct 26, 2026 · catalog updated Oct 28, 2026 · Red Hat Red Hat Enterprise Linux

Last checked Nov 5, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-115922. EPSS is 0.13%. Act only if a listed version of Red Hat Red Hat Enterprise Linux is installed.

Severity

Medium6.2

Known exploitation

Not in CISA/VulnCheck KEV

EPSS

0.13%

Remediation

Version ranges on file

Affected products

pip onnx · pypi onnx

## Summary ONNX's Python tensor-materialization helpers could allocate memory according to attacker-controlled tensor dimensions without verifying that a packed sub-byte payload contained the declared number of elements. A very small model could therefore cause a disproportionately large allocation when an application called or constructed with the model. The issue affected , , , , and tensors stored in either or packed . ## Technical details The vulnerable and paths first allocated a small array based on the available packed bytes, then resized it to the shape declared in . They did not first confirm that the payload encoded enough logical elements for that shape. For example, the reporter demonstrated a 66-byte model containing one packed byte and a declared dimension of 700,000,000. The model passed and allocated approximately 700 MB while materializing the initializer, followed by another large allocation when executing the reference evaluator. Loading, checking, or running shape inference on the serialized model alone did not trigger the allocation. The vulnerable tensor had to be materialized. ## Impact An application that materializes packed tensors from an untrusted model can exhaust available memory, causing denial of service. Memory corruption and code execution were not demonstrated. ## Affected versions - Affected: ONNX through 1.21.0 - Patched: ONNX 1.22.0 ## Remediation Upgrade to ONNX 1.22.0 or later. The primary fix validates the logical element count before resizing the unpacked NumPy array. A complementary checker change rejects an undersized packed payload before materialization. - Materialization fix: [onnx/onnx#8033](https://github.com/onnx/onnx/pull/8033) - Checker defense-in-depth: [onnx/onnx#8038](https://github.com/onnx/onnx/pull/8038) The five affected tensor types and both storage formats were re-tested against the published ONNX 1.23.2 wheel and are rejected before the oversized allocation. To verify the behavior using a released vulnerab