---
id: CVE-2026-34445
title: >-
  ONNX: ONNX: Denial of Service and potential information disclosure via
  malicious model metadata (CVE-2026-34445)
summary: >-
  A flaw was found in Open Neural Network Exchange (ONNX). An attacker could
  exploit a vulnerability in how ONNX processes model metadata, specifically
  within the ExternalDataInfo class. By crafting a malicious ONNX model, an
  attacker could …
severity: high
cvss: 7.3
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H'
cvssSource: vendor
cwe: CWE-915
vendor: Red Hat
product: Red Hat OpenShift AI 3.3
affected:
  - openshift_ai_rhoai
  - openshift_ai 2.25
  - openshift_ai 3.3
patched:
  - openshift_ai 2.25
  - openshift_ai 3.3
published: '2026-04-01'
updated: '2026-09-30'
sourceUpdated: '2026-09-30T16:55:43+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34445.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34445.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-34445'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2453930'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-34445'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-34445'
  - url: >-
      https://github.com/onnx/onnx/commit/e30c6935d67cc3eca2fa284e37248e7c0036c46b
  - url: 'https://github.com/onnx/onnx/pull/7751'
  - url: 'https://github.com/onnx/onnx/security/advisories/GHSA-538c-55jv-c5g9'
  - url: 'https://access.redhat.com/errata/RHSA-2026:65126'
  - url: 'https://access.redhat.com/errata/RHSA-2026:73987'
  - url: 'https://github.com/onnx/onnx'
tags:
  - csaf
  - vex
  - red-hat
  - osv
  - pip
epss: 0.00288
epssPercentile: 0.21175
aliases:
  - GHSA-538c-55jv-c5g9
  - PYSEC-2026-2240
ecosystem: pip
scores:
  vendor: 7.3
  osv: 8.6
ingestedAt: '2026-07-13T18:57:52.931Z'
---

## Overview

A flaw was found in Open Neural Network Exchange (ONNX). An attacker could exploit a vulnerability in how ONNX processes model metadata, specifically within the ExternalDataInfo class. By crafting a malicious ONNX model, an attacker could overwrite internal object properties, leading to a denial of service, which makes the system unavailable. This vulnerability could also result in limited information disclosure or data alteration.

## Vendor advisories

- **RHSA-2026:65126** · Red Hat · fixed in: Red Hat OpenShift AI 2.25 · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65126)
- **RHSA-2026:73987** · Red Hat · fixed in: Red Hat OpenShift AI 3.3 · released 2026-09-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:73987)
- **Red Hat VEX** · Moderate · affected: Red Hat OpenShift AI (RHOAI) · no fix planned: Red Hat OpenShift AI (RHOAI) · updated 2026-09-30 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34445.json)

**ONNX: ONNX: Denial of Service and potential information disclosure via malicious model metadata** — rated Moderate by Red Hat. Released 2026-04-01, updated 2026-09-30.

Affected:

- Red Hat OpenShift AI (RHOAI)

Fixed:

- Red Hat OpenShift AI 2.25
- Red Hat OpenShift AI 3.3

No fix planned:

- Red Hat OpenShift AI (RHOAI)

Not affected:

- Red Hat OpenShift AI 2.25
- Red Hat OpenShift AI 3.3

## Remediation

For Red Hat OpenShift AI 2.25.11 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:

https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ https://access.redhat.com/errata/RHSA-2026:65126
For Red Hat OpenShift AI 3.3.7 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:

https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ https://access.redhat.com/errata/RHSA-2026:73987

## Package advisory (CVE-2026-34445)

Affected packages:

- `onnx < 1.21.0`

Patched in:

- `onnx 1.21.0`

Source: https://osv.dev/vulnerability/GHSA-538c-55jv-c5g9