CVE-2026-115920: ONNX ConvTranspose shape inference crash from malformed weight tensor

Summary

From ONNX 1.2.1 through 1.22.0, ConvTranspose shape inference indexes an empty effective_kernel_shape when a weight tensor has fewer than three dimensions and no kernel_shape attribute is set. An untrusted model that passes onnx.checker.check_model() can crash onnx.shape_inference.infer_shapes(), causing denial of service; no confidentiality or integrity impact was demonstrated.

Mitigation

Fixed in 1.22.0.

Related items

• MediumCVE-2026-115922: Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to 1.22.0…Similar attack · NVD/CVE Database
• MediumCVE-2026-115921: ONNX shape inference crash from malicious model scan attributesSimilar attack · NVD/CVE Database
• MediumCVE-2026-115919: ONNX shape inference out-of-bounds read via malformed RNN, LSTM and GRU nodesSimilar attack · NVD/CVE Database
• MediumCVE-2026-115918: vLLM Jinja chat template injection through /v1/responses endpointSimilar attack · NVD/CVE Database
• LowCVE-2026-115917: vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the OpenAI-compatible server…Similar attack · NVD/CVE Database