CVE-2026-115922: ONNX: Denial of service via unchecked expansion of packed sub-byte tensors in ONNX Python APIs
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to 1.22.0, unpack2bit() and unpack4bit() resize unpacked arrays according to attacker-controlled TensorProto.dims without verifying that rawdata or int32data encodes the declared number of elements. Materializing an untrusted UINT2, INT2, UINT4, INT4, or FLOAT4E2M1 tensor through onnx.numpyhelper.toarray() or onnx.reference.ReferenceEvaluator can therefore expand a small packed payload into a disproportionately large allocation and exhaust memory. This issue is fixed in version 1.22.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ONNXto a version that resolves this vulnerability.Fixed in 1.22.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using ONNX versions prior to 1.22.0 are exposed when they materialize untrusted UINT2, INT2, UINT4, INT4, or FLOAT4E2M1 TensorProto values through onnx.numpy_helper.to_array() or onnx.reference.ReferenceEvaluator.
What does an attacker need to trigger the denial of service?
An attacker needs to supply a crafted packed sub-byte TensorProto whose dims declare far more elements than are encoded in raw_data or int32_data. No privileges or user interaction are required, but the vulnerable Python API must process the tensor.
What is the practical impact?
A small packed payload can cause ONNX to allocate a disproportionately large unpacked array, potentially exhausting available memory and causing a denial of service. The provided information does not indicate confidentiality or integrity impact.
What should teams do if they process untrusted ONNX models or tensors?
Upgrade ONNX to version 1.22.0. Until then, avoid materializing untrusted affected sub-byte tensor types with onnx.numpy_helper.to_array() or onnx.reference.ReferenceEvaluator.