ONNX: Denial of service via unchecked expansion of packed sub-byte tensors in ONNX Python APIs
影響: pip:onnx <= 1.21.0 → 1.22.0
ONNX's Python tensor-materialization helpers could allocate memory according to attacker-controlled tensor dimensions without verifying that a packed sub-byte payload contained the declared number of elements. A very small model could therefore cause a disproportionately large allocation when an application called onnx.numpy_helper.to_array() or constructed onnx.reference.ReferenceEvaluator with the model. The issue affected UINT2, INT2, UINT4, INT4, and FLOAT4E2M1 tensors stored in either raw_…
X で速報を受け取る悪用・大規模な漏洩・障害を、対処法と一緒に。
フォロー @vulnpulse_app| CVE | CVE-2026-115922 |
|---|---|
| 情報源 | GitHub Advisory Database |
| 取得日時 | 2026/10/29 09:48 |
| データ | Markdown JSON |
2026/10/29 06:16、GitHub Advisory Databaseが「ONNX: Denial of service via unchecked expansion of packed sub-byte tensors in ONNX Python APIs」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「警告」(medium) です。関連する技術: Python。CVE: CVE-2026-115922。