{"id":"ghsa-ghsa-m4pr-6v3c-6fgr","seq":2056922,"kind":"advisory","title":"ONNX: Null Pointer Dereference in ScanInferenceFunction Due to Missing Required Attribute","url":"https://github.com/advisories/GHSA-m4pr-6v3c-6fgr","permalink":"https://vulnpulse.app/items/ghsa-ghsa-m4pr-6v3c-6fgr","summary":"影響: pip:onnx >= 1.4.0, <= 1.21.0 → 1.22.0\nONNX shape inference did not safely validate the required Scan num_scan_inputs attribute. Two malformed values could terminate or disrupt the process: 1. If the attribute was missing, ctx.getAttribute(\"num_scan_inputs\") returned null and was dereferenced. 2. If the attribute was negative, conversion to size_t produced a very large value that reached a vector allocation and raised std::length_error. The negative-value variant passed onnx.checker.check_model() before reaching shape inference. Tec…","severity":"medium","techs":["python"],"cves":["CVE-2026-115921"],"tags":["GHSA-m4pr-6v3c-6fgr","onnx"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-28T21:16:30.000Z","fetched_at":"2026-10-29T00:48:52.653Z"}