MediumVulnerabilityCVE-2026-115919updated 28 Oct 2026, 21:16 UTC

ONNX: Out-of-Bounds Read in RNN/GRU/LSTM Shape Inference (Old Opsets, Missing Rank Check)

Fixed in onnx 1.22.0Official source

Severity	MediumCVSS 6.2 of 10
Being exploited?	UnclearNo reports either way yet
Fix available?	Yesonnx 1.22.0 · since 28 Oct 2026
How sure is this?	Official sourceBacked by an official source

Are you affected?

Package / product	Affected versions	Fixed in
onnx · pip	<= 1.21.0	1.22.0

Timeline

28 Oct 2026, 21:16 UTC
Publicly disclosed
28 Oct 2026, 21:16 UTC
Reported by GitHub Advisory · GitHub Advisory
28 Oct 2026, 21:16 UTC
Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

ONNX: Out-of-Bounds Read in RNN/GRU/LSTM Shape Inference (Old Opsets, Missing Rank Check)GitHub Advisory · 28 Oct 2026, 21:16 UTC

Technical details

ID: CVE-2026-115919 · GHSA-48m4-24cq-37qf
CVSS: 6.2 / 10
EPSS: 0.2% chance of exploitation within 30 days
Disclosed: 28 Oct 2026, 21:16 UTC
On Zero Radar: 28 Oct 2026, 21:16 UTC (0 min after disclosure)
Last change: 28 Oct 2026, 21:16 UTC

This entry has not been explained yet. The text comes straight from the source. How Zero Radar works

ONNX: Out-of-Bounds Read in RNN/GRU/LSTM Shape Inference (Old Opsets, Missing Rank Check) · Zero Radar