onnx

Follow this package

Get the evidence behind this dependency. Browse imported advisories below, or check an exact version against OSV now. View source coverage.

Check the version you ship.

Get a fresh OSV lookup for an exact release. We send the package name and version to OSV without storing a report.

Advisories & recorded fixes

medium6.2

CVE-2026-115922Fix available

ONNX: Denial of service via unchecked expansion of packed sub-byte tensors in ONNX Python APIs

PyPI / onnx

5 days ago

onnx PyPI

Affected range	Recorded fix
Earlier releases before 1.22.0Ecosystem versions	1.22.0

Version evidence: OSV · GHSA-q69g-f4f5-v8m7

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "1.22.0"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "0.1",
    "0.2",
    "0.2.1",
    "1.0.0",
    "1.0.1",
    "1.1.0",
    "1.1.1",
    "1.1.2",
    "1.10.0",
    "1.10.1",
    "1.10.2",
    "1.11.0",
    "1.12.0",
    "1.13.0",
    "1.13.1",
    "1.14.0",
    "1.14.1",
    "1.15.0",
    "1.16.0",
    "1.16.1",
    "1.16.2",
    "1.17.0",
    "1.18.0",
    "1.19.0",
    "1.19.1",
    "1.19.1rc1",
    "1.2.1",
    "1.2.2",
    "1.2.3",
    "1.20.0",
    "1.20.0rc1",
    "1.20.0rc2",
    "1.20.1",
    "1.20.1rc1",
    "1.21.0",
    "1.21.0rc1",
    "1.21.0rc2",
    "1.21.0rc3",
    "1.21.0rc4",
    "1.22.0rc1",
    "1.22.0rc2",
    "1.3.0",
    "1.4.0",
    "1.4.1",
    "1.5.0",
    "1.6.0",
    "1.7.0",
    "1.8.0",
    "1.8.1",
    "1.9.0"
  ]
}

medium6.2

CVE-2026-115921Fix available

ONNX: Null Pointer Dereference in ScanInferenceFunction Due to Missing Required Attribute

PyPI / onnx

5 days ago

onnx PyPI

Affected range	Recorded fix
From 1.4.0 before 1.22.0Ecosystem versions	1.22.0

Version evidence: OSV · GHSA-m4pr-6v3c-6fgr

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "1.4.0"
        },
        {
          "fixed": "1.22.0"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "1.10.0",
    "1.10.1",
    "1.10.2",
    "1.11.0",
    "1.12.0",
    "1.13.0",
    "1.13.1",
    "1.14.0",
    "1.14.1",
    "1.15.0",
    "1.16.0",
    "1.16.1",
    "1.16.2",
    "1.17.0",
    "1.18.0",
    "1.19.0",
    "1.19.1",
    "1.19.1rc1",
    "1.20.0",
    "1.20.0rc1",
    "1.20.0rc2",
    "1.20.1",
    "1.20.1rc1",
    "1.21.0",
    "1.21.0rc1",
    "1.21.0rc2",
    "1.21.0rc3",
    "1.21.0rc4",
    "1.22.0rc1",
    "1.22.0rc2",
    "1.4.0",
    "1.4.1",
    "1.5.0",
    "1.6.0",
    "1.7.0",
    "1.8.0",
    "1.8.1",
    "1.9.0"
  ]
}

medium6.2

CVE-2026-115920Fix available

ONNX: Out-of-bounds read in ConvTranspose shape inference via undersized weight rank

PyPI / onnx

5 days ago

onnx PyPI

Affected range	Recorded fix
From 1.2.1 before 1.22.0Ecosystem versions	1.22.0

Version evidence: OSV · GHSA-6pwm-x34p-fvj2

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "1.2.1"
        },
        {
          "fixed": "1.22.0"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "1.10.0",
    "1.10.1",
    "1.10.2",
    "1.11.0",
    "1.12.0",
    "1.13.0",
    "1.13.1",
    "1.14.0",
    "1.14.1",
    "1.15.0",
    "1.16.0",
    "1.16.1",
    "1.16.2",
    "1.17.0",
    "1.18.0",
    "1.19.0",
    "1.19.1",
    "1.19.1rc1",
    "1.2.1",
    "1.2.2",
    "1.2.3",
    "1.20.0",
    "1.20.0rc1",
    "1.20.0rc2",
    "1.20.1",
    "1.20.1rc1",
    "1.21.0",
    "1.21.0rc1",
    "1.21.0rc2",
    "1.21.0rc3",
    "1.21.0rc4",
    "1.22.0rc1",
    "1.22.0rc2",
    "1.3.0",
    "1.4.0",
    "1.4.1",
    "1.5.0",
    "1.6.0",
    "1.7.0",
    "1.8.0",
    "1.8.1",
    "1.9.0"
  ]
}

medium6.2

CVE-2026-115919Fix available

ONNX: Out-of-Bounds Read in RNN/GRU/LSTM Shape Inference (Old Opsets, Missing Rank Check)

PyPI / onnx

5 days ago

onnx PyPI

Affected range	Recorded fix
Earlier releases before 1.22.0Ecosystem versions	1.22.0

Version evidence: OSV · GHSA-48m4-24cq-37qf

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "1.22.0"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "0.1",
    "0.2",
    "0.2.1",
    "1.0.0",
    "1.0.1",
    "1.1.0",
    "1.1.1",
    "1.1.2",
    "1.10.0",
    "1.10.1",
    "1.10.2",
    "1.11.0",
    "1.12.0",
    "1.13.0",
    "1.13.1",
    "1.14.0",
    "1.14.1",
    "1.15.0",
    "1.16.0",
    "1.16.1",
    "1.16.2",
    "1.17.0",
    "1.18.0",
    "1.19.0",
    "1.19.1",
    "1.19.1rc1",
    "1.2.1",
    "1.2.2",
    "1.2.3",
    "1.20.0",
    "1.20.0rc1",
    "1.20.0rc2",
    "1.20.1",
    "1.20.1rc1",
    "1.21.0",
    "1.21.0rc1",
    "1.21.0rc2",
    "1.21.0rc3",
    "1.21.0rc4",
    "1.22.0rc1",
    "1.22.0rc2",
    "1.3.0",
    "1.4.0",
    "1.4.1",
    "1.5.0",
    "1.6.0",
    "1.7.0",
    "1.8.0",
    "1.8.1",
    "1.9.0"
  ]
}