Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-34445 is a high-severity Improper Input Validation (CWE-20) vulnerability in Linuxfoundation Onnx. Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Endpoint Denial of Service (T1499); ranked at the 21th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
This vulnerability is AI-related — categorised as Machine Learning Libraries; in the Supply Chain and Deployment risk domain.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-34445 is a vulnerability in the Open Neural Network Exchange (ONNX) library, an open standard for machine learning model interoperability, affecting versions prior to 1.21.0. The issue lies in the ExternalDataInfo class, which uses Python's setattr() function to load metadata—such as file paths or data lengths—directly from an ONNX model file without validating the keys present in the file. This lack of validation enables an attacker to craft a malicious ONNX model that overwrites internal object properties of the class.
The vulnerability can be exploited remotely by an unauthenticated attacker with no privileges required and no user interaction needed, as indicated by its CVSS 3.1 score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H). Exploitation occurs when a victim system loads or processes the malicious ONNX model file, potentially leading to low confidentiality impact, low integrity impact, and high availability impact. The associated weakness identifiers are CWE-20 (Improper Input Validation), CWE-400 (Uncontrolled Resource Consumption), and CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes).
Mitigation is available through an upgrade to ONNX version 1.21.0, where the issue has been patched. Official resources detail the fix, including the patch commit at https://github.com/onnx/onnx/commit/e30c6935d67cc3eca2fa284e37248e7c0036c46b, the corresponding pull request at https://github.com/onnx/onnx/pull/7751, and the GitHub security advisory at https://github.com/onnx/onnx/security/advisories/GHSA-538c-55jv-c5g9.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-17985
Vulnerability Data
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, the ExternalDataInfo class in ONNX was using Python’s setattr() function to load metadata (like file paths or data lengths) directly from an ONNX…
more
model file. It didn’t check if the "keys" in the file were valid. Due to this, an attacker could craft a malicious model that overwrites internal object properties. This issue has been patched in version 1.21.0.
- CWE(s)
AI Security AnalysisAI
- AI Category
- Machine Learning Libraries
- Risk Domain
- Supply Chain and Deployment
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Matched keywords: machine learning, neural network, onnx
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 6 hardening rules · 3 OS baselines
—
Mitigating Controls (NIST 800-53 r5) AI
Enforces authorizations so that only permitted attributes may be modified on an object.
Limits the set of modifiable attributes a subject is authorized to touch.
Developer testing and evaluation can discover missing input validation through analysis or test cases.
SC-5 directly limits the effects of resource-exhaustion events that constitute uncontrolled consumption.
SC-6 enforces explicit allocation limits on resources, structurally preventing the weakness from occurring.
SI-10 directly requires validity checks on information inputs, structurally preventing improper or missing validation.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Continuous monitoring of computing resources can detect resource exhaustion but does not itself enforce allocation limits.
Resilience mechanisms such as avoiding single points of failure indirectly reduce impact of resource exhaustion.
Explicitly requires monitoring and maintaining resource capacity, directly addressing uncontrolled consumption to preserve availability.
Hardened configuration baselines can include resource quotas and limits that constrain consumption.
Secure SDLC practices directly require and enforce input validation during development.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Pre-agreed severity-based prioritization and resource allocation during incident triage reduce the likelihood that an attacker-induced resource exhaustion will overwhelm the organization before corrective action is taken.
Business-continuity plans that include resource-management controls reduce the likelihood that an attacker can trigger uncontrolled resource consumption by forcing the system into a degraded or fallback state.
Defining RTOs and capacity requirements for ICT services during business-impact analysis forces organizations to provision sufficient resources and throttling mechanisms, reducing the likelihood that an attacker can induce denial-of-service through uncontrolled resource consumption.
Early notification of anomalous resource consumption or system malfunctions enables throttling or isolation before availability is lost.
By duplicating processing facilities and load-balancing across instances, the control reduces the likelihood that a single resource-exhaustion attack will render the service unavailable.
Specifying log storage limits and rotation procedures reduces the risk that unbounded log growth will exhaust disk or memory resources and cause denial of service.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (higher-evidence rows only; rows rated `none` are excluded).
RHEL 8 (1 rule)
- V-230265 RHEL 8 must prevent the installation of software, patches, service packs, device drivers, or operating system components of local packages without verification they have been digitally signed using a certificate that is issued by a Certificate Authority (CA) that is recognized and approved by the organization. prevents CWE-20