ONNX: untrusted model crashes shape inference via missing or negative num_scan_inputs

Impact

The Scan operator's shape-inference functions do not validate the required num_scan_inputs attribute: a missing attribute is dereferenced as a null pointer, and a negative value becomes a huge size_t and reaches an oversized-allocation path. A model file is enough to terminate or wedge whatever process runs shape inference - a model-conversion step, a validation gate in a serving pipeline, or an inference server loading the graph. The nastier detail is that a model with a negative value still passes onnx.checker.check_model(), so a pre-flight check that operators rely on does not catch it. On a shared GPU fleet this is a tenant-supplied-model crash of the serving or conversion worker, not host compromise, but a crash loop on model load keeps accelerators idle.

Who can reach it

Local to the process that loads the model: anyone who can submit an ONNX model file into a conversion, validation or serving path. Authentication depends on your model-upload surface; no privileges on the host are needed.

What to do

Upgrade onnx to 1.22.0 and restart the services that load models (conversion workers, inference servers embedding onnx shape inference). Process restart only - no node drain or reboot. Until then, do not run shape inference on models from untrusted tenants, and do not treat onnx.checker.check_model() as a sufficient gate for this class of input.

References

Related entries

• ONNX: packed low-bit tensor expands to an unbounded allocation and exhausts host memoryCVE-2026-115922 · ONNX numpy_helper / ReferenceEvaluator (_unpack_2bit and _unpack_4bit sizing from TensorProto.dims)Medium
• Weights & Biases OpenUI: Unauthenticated endpoints allow file upload and downloadCVE-2024-10649 · Weights & Biases OpenUIMedium
• Dask distributed (+ Jupyter proxy): Exposure when Dask, JupyterLab and jupyter-server-proxy are combinedCVE-2026-23528 · Dask distributed (+ Jupyter proxy)Medium
• tract: unchecked size multiplication when reading an NNEF tensor gives a heap over-read on model loadCVE-2026-55093 · tract-nnef (read_tensor in nnef/src/tensors.rs)Medium
• tract: ONNX external_data path is not sanitised, so loading a model reads arbitrary local filesCVE-2026-55832 · tract-onnx (external_data path handling, get_external_resources / MmapDataResolver)Medium
• BentoML 1.3.9 (open redirect in the serving UI): A crafted URL against the BentoML server bounces the visitor to anNCVD-2025-017-bentoml-1-3-9-open-redirect-in-t · BentoML 1.3.9 (open redirect in the serving UI)Medium