CVE-2026-34445
published 2026-04-01CVE-2026-34445: Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, the ExternalDataInfo class in ONNX was…
PriorityP351high8.6CVSS 3.1
AVNACLPRNUINSUCLILAH
EPSS
0.29%
21.0th percentile
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, the ExternalDataInfo class in ONNX was using Python’s setattr() function to load metadata (like file paths or data lengths) directly from an ONNX model file. It didn’t check if the "keys" in the file were valid. Due to this, an attacker could craft a malicious model that overwrites internal object properties. This issue has been patched in version 1.21.0.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | onnx | — | — |
| linuxfoundation | onnx | < 1.21.0 | 1.21.0 |
| msrc | azl3_pytorch_2.2.2-12_on_azure_linux_3.0 | — | — |
| msrc | cbl2_pytorch_2.0.0-15_on_cbl_mariner_2.0 | — | — |
| onnx | onnx | < 1.21.0 | 1.21.0 |
| onnx | onnx | >= 0 < 1.21.0 | 1.21.0 |
CVSS provenance
nvdv3.18.6HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
osv8.6HIGH
vendor_debian8.6HIGH
vendor_msrc8.6HIGH
vendor_redhat8.6HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2026-34445: (Open Neural Network Exchange (ONNX) is an open standard for machine le
osv·2026-04-02·CVSS 8.6
CVE-2026-34445 [HIGH] CVE-2026-34445: (Open Neural Network Exchange (ONNX) is an open standard for machine le
(Open Neural Network Exchange (ONNX) is an open standard for machine le ...)
OSV
CVE-2026-34445: Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability
osv·2026-04-01·CVSS 8.6
CVE-2026-34445 [HIGH] CVE-2026-34445: Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, the ExternalDataInfo class in ONNX was using Python’s setattr() function to load metadata (like file paths or data lengths) directly from an ONNX model file. It didn’t check if the "keys" in the file were valid. Due to this, an attacker could craft a malicious model that overwrites internal object properties. This issue has been patched in version 1.21.0.
GHSA
ONNX: Malicious ONNX models can crash servers by exploiting unprotected object settings.
ghsa·2026-04-01
CVE-2026-34445 [HIGH] CWE-20 ONNX: Malicious ONNX models can crash servers by exploiting unprotected object settings.
ONNX: Malicious ONNX models can crash servers by exploiting unprotected object settings.
### Summary
The ExternalDataInfo class in ONNX was using Python’s setattr() function to load metadata (like file paths or data lengths) directly from an ONNX model file. The problem? It didn’t check if the "keys" in the file were valid. Because it blindly trusted the file, an attacker could craft a malicious model that overwrites internal object properties.
### Why its Dangerous
**Instant Crash DoS**: An attacker can set the length property to a massive number like 9 petabytes. When the system tries to load the model, it attempts to allocate all that RAM at once, causing the server to crash or freeze Out of Memory.
**Access Bypass**: By setting a negative offset -1, an attacker can trick the system
OSV
ONNX: Malicious ONNX models can crash servers by exploiting unprotected object settings.
osv·2026-04-01
CVE-2026-34445 [HIGH] ONNX: Malicious ONNX models can crash servers by exploiting unprotected object settings.
ONNX: Malicious ONNX models can crash servers by exploiting unprotected object settings.
### Summary
The ExternalDataInfo class in ONNX was using Python’s setattr() function to load metadata (like file paths or data lengths) directly from an ONNX model file. The problem? It didn’t check if the "keys" in the file were valid. Because it blindly trusted the file, an attacker could craft a malicious model that overwrites internal object properties.
### Why its Dangerous
**Instant Crash DoS**: An attacker can set the length property to a massive number like 9 petabytes. When the system tries to load the model, it attempts to allocate all that RAM at once, causing the server to crash or freeze Out of Memory.
**Access Bypass**: By setting a negative offset -1, an attacker can trick the system
Microsoft
ONNX: Malicious ONNX models can crash servers by exploiting unprotected object settings.
vendor_msrc·2026-04-02·CVSS 8.6
CVE-2026-34445 [HIGH] CWE-20 ONNX: Malicious ONNX models can crash servers by exploiting unprotected object settings.
ONNX: Malicious ONNX models can crash servers by exploiting unprotected object settings.
Mariner: Mariner
GitHub_M: GitHub_M
Customer Action Required: Yes
Red Hat
ONNX: python: ONNX: Denial of Service and potential information disclosure via malicious model metadata
vendor_redhat·2026-04-01·CVSS 8.6
CVE-2026-34445 [HIGH] CWE-915 ONNX: python: ONNX: Denial of Service and potential information disclosure via malicious model metadata
ONNX: python: ONNX: Denial of Service and potential information disclosure via malicious model metadata
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, the ExternalDataInfo class in ONNX was using Python’s setattr() function to load metadata (like file paths or data lengths) directly from an ONNX model file. It didn’t check if the "keys" in the file were valid. Due to this, an attacker could craft a malicious model that overwrites internal object properties. This issue has been patched in version 1.21.0.
A flaw was found in Open Neural Network Exchange (ONNX). An attacker could exploit a vulnerability in how ONNX processes model metadata, specifically within the ExternalDataInfo class. By crafting a malicious ONNX mo
Debian
CVE-2026-34445: onnx - Open Neural Network Exchange (ONNX) is an open standard for machine learning int...
vendor_debian·2026·CVSS 8.6
CVE-2026-34445 [HIGH] CVE-2026-34445: onnx - Open Neural Network Exchange (ONNX) is an open standard for machine learning int...
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, the ExternalDataInfo class in ONNX was using Python’s setattr() function to load metadata (like file paths or data lengths) directly from an ONNX model file. It didn’t check if the "keys" in the file were valid. Due to this, an attacker could craft a malicious model that overwrites internal object properties. This issue has been patched in version 1.21.0.
Scope: local
bookworm: open
bullseye: open
forky: open
sid: open
trixie: open
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-34445 onnx: ONNX: Denial of Service and potential information disclosure via malicious model metadata [fedora-42]
bugzilla·2026-04-03·CVSS 8.6
CVE-2026-34445 [HIGH] CVE-2026-34445 onnx: ONNX: Denial of Service and potential information disclosure via malicious model metadata [fedora-42]
CVE-2026-34445 onnx: ONNX: Denial of Service and potential information disclosure via malicious model metadata [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It is Fedora's policy to close all bug reports from releases that are no longer
maintained. At that time this bug will be closed as EOL if it remains open with a
'version' of '42'.
Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a curr
Bugzilla
CVE-2026-34445 ONNX: ONNX: Denial of Service and potential information disclosure via malicious model metadata
bugzilla·2026-04-01·CVSS 8.6
CVE-2026-34445 [HIGH] CVE-2026-34445 ONNX: ONNX: Denial of Service and potential information disclosure via malicious model metadata
CVE-2026-34445 ONNX: ONNX: Denial of Service and potential information disclosure via malicious model metadata
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, the ExternalDataInfo class in ONNX was using Python’s setattr() function to load metadata (like file paths or data lengths) directly from an ONNX model file. It didn’t check if the "keys" in the file were valid. Due to this, an attacker could craft a malicious model that overwrites internal object properties. This issue has been patched in version 1.21.0.
Wiz
CVE-2026-34445 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 8.6
CVE-2026-34445 [HIGH] CVE-2026-34445 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-34445 :
Python vulnerability analysis and mitigation
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, the ExternalDataInfo class in ONNX was using Python’s setattr() function to load metadata (like file paths or data lengths) directly from an ONNX model file. It didn’t check if the "keys" in the file were valid. Due to this, an attacker could craft a malicious model that overwrites internal object properties. This issue has been patched in version 1.21.0.
Source : NVD
## 8.6
Score
Published April 1, 2026
Severity HIGH
CNA Score 8.6
Affected Technologies
Python
Wolfi
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percent
2026-04-01
Published