UBUNTU-CVE-2026-115919: Medium severity ubuntu/onnx vulnerability
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to 1.22.0, RNNShapeInferenceopset1to6() processes malformed RNN and LSTM nodes from opsets 1 through 6 and GRU nodes from opsets 3 through 6 without verifying that the first input has rank three. The function accesses dim(0) and dim(1) on an undersized protobuf shape, which can read outside the intended repeated field and terminate an application when onnx.shapeinference.infershapes() processes an untrusted model that can pass onnx.checker.checkmodel(). This issue is fixed in version 1.22.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
onnxto a version that resolves this vulnerability.Fixed in 1.22.0
Event History
Frequently Asked Questions
What workloads are exposed to this issue?
Applications are exposed if they run onnx.shape_inference.infer_shapes() on untrusted ONNX models. The affected path involves malformed RNN or LSTM nodes using opsets 1 through 6, or GRU nodes using opsets 3 through 6.
Does an attacker need to bypass ONNX model validation?
No. A malicious model can pass onnx.checker.check_model() and still trigger the issue during shape inference.
What is the impact of successful exploitation?
The malformed shape can cause an out-of-bounds read from the intended protobuf repeated field and terminate the application, resulting in a denial of service.
What version contains the fix?
The issue is fixed in ONNX version 1.22.0. Systems using an earlier version should avoid running shape inference on untrusted models until they can update.