Denial of Service Vulnerability in ONNX Framework
CVE-2026-44512

5.5MEDIUM

Key Information:

Vendor

Onnx

Status
Onnx
Vendor
CVE Published:
8 July 2026

What is CVE-2026-44512?

A denial of service vulnerability occurs in the ONNX Framework's version converter function. When processing an untrusted model that utilizes an Upsample node with zero inputs, the function can dereference a null pointer, leading to an unrecoverable crash. This vulnerability affects versions of ONNX from 1.9.0 up to, but not including, 1.22.0. Users are advised to upgrade to version 1.22.0 or later to mitigate this risk.

Affected Version(s)

onnx >= 1.9.0, < 1.22.0

References

https://github.com/onnx/onnx/security/advisories/GHSA-hwp...
x_refsource_CONFIRM
https://github.com/onnx/onnx/pull/7813
x_refsource_MISC
https://github.com/onnx/onnx/commit/cd310408165ad47c3cd7e...
x_refsource_MISC

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.