Hi,

The following vulnerabilities were published for onnx.

CVE-2026-115919[0]:
| Open Neural Network Exchange (ONNX) is an open standard for machine
| learning interoperability. Prior to 1.22.0,
| RNNShapeInference_opset1_to_6() processes malformed RNN and LSTM
| nodes from opsets 1 through 6 and GRU nodes from opsets 3 through 6
| without verifying that the first input has rank three. The function
| accesses dim(0) and dim(1) on an undersized protobuf shape, which
| can read outside the intended repeated field and terminate an
| application when onnx.shape_inference.infer_shapes() processes an
| untrusted model that can pass onnx.checker.check_model(). This issue
| is fixed in version 1.22.0.


CVE-2026-115920[1]:
| Open Neural Network Exchange (ONNX) is an open standard for machine
| learning interoperability. From 1.2.1 until 1.22.0, ConvTranspose
| shape inference processes a weight tensor with fewer than three
| dimensions without a kernel_shape attribute by deriving an empty
| effective_kernel_shape and indexing it for the input's spatial
| dimensions. The flaw affects convTransposeShapeInference_opset11()
| and the current inference path, and an untrusted model that can pass
| onnx.checker.check_model() can crash
| onnx.shape_inference.infer_shapes(), causing denial of service
| without demonstrated confidentiality or integrity impact. This issue
| is fixed in version 1.22.0.


CVE-2026-115921[2]:
| Open Neural Network Exchange (ONNX) is an open standard for machine
| learning interoperability. From 1.4.0 until 1.22.0,
| ScanInferenceFunction, ScanInferenceFunction_opset8, and
| ScanInferenceFunction_opset9 do not safely validate the required
| num_scan_inputs attribute. A missing attribute is dereferenced as a
| null pointer, while a negative value is converted to size_t and can
| reach an exceptional oversized allocation path. An untrusted model
| can therefore terminate or disrupt shape inference, including a
| negative-value model that can pass onnx.checker.check_model(). This
| issue is fixed in version 1.22.0.


CVE-2026-115922[3]:
| Open Neural Network Exchange (ONNX) is an open standard for machine
| learning interoperability. Prior to 1.22.0, _unpack_2bit() and
| _unpack_4bit() resize unpacked arrays according to attacker-
| controlled TensorProto.dims without verifying that raw_data or
| int32_data encodes the declared number of elements. Materializing an
| untrusted UINT2, INT2, UINT4, INT4, or FLOAT4E2M1 tensor through
| onnx.numpy_helper.to_array() or onnx.reference.ReferenceEvaluator
| can therefore expand a small packed payload into a
| disproportionately large allocation and exhaust memory. This issue
| is fixed in version 1.22.0.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-115919
https://www.cve.org/CVERecord?id=CVE-2026-115919
[1] https://security-tracker.debian.org/tracker/CVE-2026-115920
https://www.cve.org/CVERecord?id=CVE-2026-115920
[2] https://security-tracker.debian.org/tracker/CVE-2026-115921
https://www.cve.org/CVERecord?id=CVE-2026-115921
[3] https://security-tracker.debian.org/tracker/CVE-2026-115922
https://www.cve.org/CVERecord?id=CVE-2026-115922

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore