Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, the ExternalDataInfo class in ONNX was using Python’s setattr() function to load metadata (like file paths or data lengths) directly from an ONNX model file. It didn’t check if the "keys" in the file were valid. Due to this, an attacker could craft a malicious model that overwrites internal object properties. This issue has been patched in version 1.21.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-04-02 | 2 | Disclosure1Patch1 |
| 2026-04-05 | 1 | Disclosure1 |
Vulnerability (CVE-2026-34445) in `ONNX` processing can crash servers via malicious models. Review input validation and harden object settings. #ONNX #CyberSecurity #DoS https://www.pulsepatch.io/posts/cve-2026-34445-onnx-model-processing-dos
Post summary
CVE-2026-34445 is a DoS vulnerability in ONNX processing that can crash servers via malicious models; users are advised to validate input and harden object settings.
[CVE-2026-34445: HIGH] Update your ONNX to version 1.21.0. Previous versions allowed potential cyber attacks by not validating model data, enabling overwriting properties.#cve,CVE-2026-34445,#cybersecurity https://cvefind.com/CVE-2026-34445
Post summary
The post advertises a high‑severity CVE (CVE‑2026‑34445) affecting ONNX prior to v1.21.0 due to insufficient model data validation and urges users to update to the patched version.
🟠 CVE-2026-34445 - High Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, the ExternalDataInfo class in ONNX was using Python’s setattr() funct... https://www.thehackerwire.com/vulnerability/CVE-2026-34445/ https://t.co/cuQHnHz5L1
Post summary
The message announces a high‑severity vulnerability in ONNX prior to version 1.21.0, giving basic technical context but no PoC, exploit, or patch details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | linuxfoundation | onnx | - | - | - |