CVE-2026-34445: linuxfoundation onnx Improper Input Validation

Vulnerability summary

CVE-2026-34445 is a high (CVSS 8.6) Improper Input Validation vulnerability in linuxfoundation onnx. EPSS estimates a 0.51% chance of exploitation in the next 30 days, higher than 42% of scored vulnerabilities.

Timeline

1. 01-04-2026
   PublishedVulnerability first disclosed.
2. 01-04-2026
   Last modifiedVulnerability information updated.

Description

Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, the ExternalDataInfo class in ONNX was using Python’s setattr() function to load metadata (like file paths or data lengths) directly from an ONNX model file. It didn’t check if the "keys" in the file were valid. Due to this, an attacker could craft a malicious model that overwrites internal object properties. This issue has been patched in version 1.21.0.

• CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
• CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
• CWE-915Improperly Controlled Modification of Dynamically-Determined Object AttributesThe product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.