CVE-2026-115919: ONNX shape inference out-of-bounds read via malformed RNN, LSTM and GRU nodes

Summary

ONNX versions prior to 1.22.0 have a flaw in RNNShapeInference_opset1_to_6(), which handles malformed RNN and LSTM nodes from opsets 1 through 6 and GRU nodes from opsets 3 through 6 without checking that the first input has rank three. The function reads dim(0) and dim(1) on an undersized protobuf shape, which can read outside the intended repeated field. An untrusted model that passes onnx.checker.check_model() can terminate an application that calls onnx.shape_inference.infer_shapes().

Mitigation

Fixed in version 1.22.0.

Related items

• MediumCVE-2026-115922: Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to 1.22.0…Similar attack · NVD/CVE Database
• MediumCVE-2026-115921: ONNX shape inference crash from malicious model scan attributesSimilar attack · NVD/CVE Database
• MediumCVE-2026-115920: ONNX ConvTranspose shape inference crash from malformed weight tensorSimilar attack · NVD/CVE Database
• MediumCVE-2026-115918: vLLM Jinja chat template injection through /v1/responses endpointSimilar attack · NVD/CVE Database
• LowCVE-2026-115917: vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the OpenAI-compatible server…Similar attack · NVD/CVE Database