Database/AI/ML frameworks & serving
ONNX: packed low-bit tensor expands to an unbounded allocation and exhausts host memory
Impact
_unpack_2bit() and _unpack_4bit() size the output array from the attacker-controlled TensorProto.dims without checking that raw_data or int32_data actually holds that many elements. A small UINT2/INT2/UINT4/INT4/FLOAT4E2M1 tensor with inflated dims therefore expands into a disproportionately large allocation when a model is materialized through onnx.numpy_helper.to_array() or onnx.reference.ReferenceEvaluator. The result is memory exhaustion in the process - and on a container-packed GPU node, an OOM kill that can take neighbouring pods with it if the memory cgroup is shared or generous. This is a distinct bug from the Scan shape-inference flaw fixed in the same release: different code path, different trigger, different commits.
Who can reach it
Local to the process loading the model: anyone who can supply an ONNX model that gets converted with numpy_helper.to_array() or evaluated with ReferenceEvaluator. No host privileges required.
What to do
Upgrade onnx to 1.22.0 and restart the model-loading services. Process restart only. Before patching, run untrusted model conversion in a container with a hard memory limit so an OOM is contained to that pod, and avoid ReferenceEvaluator on tenant-supplied quantized models.
References
Related entries
- Weights & Biases OpenUI: Unauthenticated endpoints allow file upload and downloadCVE-2024-10649 · Weights & Biases OpenUIMedium
- Dask distributed (+ Jupyter proxy): Exposure when Dask, JupyterLab and jupyter-server-proxy are combinedCVE-2026-23528 · Dask distributed (+ Jupyter proxy)Medium
- tract: unchecked size multiplication when reading an NNEF tensor gives a heap over-read on model loadCVE-2026-55093 · tract-nnef (read_tensor in nnef/src/tensors.rs)Medium
- tract: ONNX external_data path is not sanitised, so loading a model reads arbitrary local filesCVE-2026-55832 · tract-onnx (external_data path handling, get_external_resources / MmapDataResolver)Medium
- BentoML 1.3.9 (open redirect in the serving UI): A crafted URL against the BentoML server bounces the visitor to anNCVD-2025-017-bentoml-1-3-9-open-redirect-in-t · BentoML 1.3.9 (open redirect in the serving UI)Medium
- ClearML: Passwords stored in plaintext in MongoDBCVE-2024-24595 · ClearMLMedium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.