CVE-2026-44512
- Source
- https://cve.org/CVERecord?id=CVE-2026-44512
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44512.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-44512
- Aliases
- Downstream
- Related
- Published
- 2026-07-08T19:32:04Z
- Modified
- 2026-08-12T15:14:59Z
- Severity
-
- 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- ONNX: Null Pointer Dereference in Upsample Version Converter Adapter (Zero Inputs)
- Details
-
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. From 1.9.0 before 1.22.0, onnx.version_converter.convert_version() can dereference a null pointer in Upsample_6_7::adapt_upsample_6_7() in onnx/version_converter/adapters/upsample_6_7.h when processing an untrusted model with an Upsample node that has zero inputs, causing an unrecoverable denial of service. This issue is fixed in version 1.22.0.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-476" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44512.json" }- References
-
- https://github.com/onnx/onnx/releases/tag/v1.22.0
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44512.json
- https://github.com/onnx/onnx/security/advisories/GHSA-hwpq-hmq9-wj77
- https://nvd.nist.gov/vuln/detail/CVE-2026-44512
- https://github.com/onnx/onnx/commit/cd310408165ad47c3cd7eb2b86cb5b80aa2e4fdf
- https://github.com/onnx/onnx/pull/7813
Affected packages
Git / github.com/onnx/onnx
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44512.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"line_hashes": [
"226381636357998355972211205858022375418",
"220546675373840911845596329708677848389",
"209021240853009850112953091679757293798"
],
"threshold": 0.9
},
"id": "CVE-2026-44512-070cdfd9",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/onnx/onnx/commit/cd310408165ad47c3cd7eb2b86cb5b80aa2e4fdf",
"target": {
"file": "onnx/version_converter/adapters/upsample_6_7.h"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"199522231850416071128819576620608072868",
"315477578719308779624481453424750345664",
"273266747131015259969545928620769503229",
"286716148162866455281771887072102645233"
],
"threshold": 0.9
},
"id": "CVE-2026-44512-0fe9a550",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/onnx/onnx/commit/cd310408165ad47c3cd7eb2b86cb5b80aa2e4fdf",
"target": {
"file": "onnx/version_converter/adapters/upsample_9_10.h"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "316959538485690868642204556826243803547",
"length": 1645
},
"id": "CVE-2026-44512-33932cb9",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/onnx/onnx/commit/cd310408165ad47c3cd7eb2b86cb5b80aa2e4fdf",
"target": {
"file": "onnx/version_converter/adapters/broadcast_forward_compatibility.h",
"function": "adapt_broadcast_forward_compatibility"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "227421369753869401912126167576090543000",
"length": 1616
},
"id": "CVE-2026-44512-3bcfb05e",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/onnx/onnx/commit/cd310408165ad47c3cd7eb2b86cb5b80aa2e4fdf",
"target": {
"file": "onnx/version_converter/adapters/softmax_12_13.h",
"function": "adapt_softmax_12_13"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "242606061586028823846118268497354313256",
"length": 268
},
"id": "CVE-2026-44512-48029a00",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/onnx/onnx/commit/cd310408165ad47c3cd7eb2b86cb5b80aa2e4fdf",
"target": {
"file": "onnx/version_converter/adapters/cast_9_8.h",
"function": "adapt_cast_9_8"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"227574303517933355982255875219008286461",
"301029258975654240028515481821011335541",
"161813863626757371424610274775412267096",
"268338611077049337261256302808916202166"
],
"threshold": 0.9
},
"id": "CVE-2026-44512-4a6b2c0a",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/onnx/onnx/commit/cd310408165ad47c3cd7eb2b86cb5b80aa2e4fdf",
"target": {
"file": "onnx/version_converter/adapters/broadcast_forward_compatibility.h"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"57804397208287221150131411064381418077",
"220413817726087639084706582249464490560",
"190327403932943646652259212531025240088",
"97693382074938641192424484524313995596"
],
"threshold": 0.9
},
"id": "CVE-2026-44512-6e4e4d14",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/onnx/onnx/commit/cd310408165ad47c3cd7eb2b86cb5b80aa2e4fdf",
"target": {
"file": "onnx/version_converter/adapters/softmax_12_13.h"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"110783059670261045692194561216298304954",
"325109014004092804743267146403120400489",
"160955877978777959100890584957422616062",
"222818659262788441178883666336967012337"
],
"threshold": 0.9
},
"id": "CVE-2026-44512-72eecd6c",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/onnx/onnx/commit/cd310408165ad47c3cd7eb2b86cb5b80aa2e4fdf",
"target": {
"file": "onnx/version_converter/adapters/group_normalization_20_21.h"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"186094431121509823757691471959038302999",
"176274255646262786426732591121070849385",
"273390342942450168996889837189475028478",
"6514752493237561093809915979413358470"
],
"threshold": 0.9
},
"id": "CVE-2026-44512-800133f1",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/onnx/onnx/commit/cd310408165ad47c3cd7eb2b86cb5b80aa2e4fdf",
"target": {
"file": "onnx/version_converter/adapters/softmax_13_12.h"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "137935675124684083787420535947717965315",
"length": 928
},
"id": "CVE-2026-44512-8bbfe2ba",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/onnx/onnx/commit/cd310408165ad47c3cd7eb2b86cb5b80aa2e4fdf",
"target": {
"file": "onnx/version_converter/adapters/softmax_13_12.h",
"function": "adapt_softmax_13_12"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "140191200805714262779804315238754379153",
"length": 421
},
"id": "CVE-2026-44512-a5ca9cbc",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/onnx/onnx/commit/cd310408165ad47c3cd7eb2b86cb5b80aa2e4fdf",
"target": {
"file": "onnx/version_converter/adapters/upsample_9_10.h",
"function": "adapt_upsample_9_10"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "322061935208877344990502881489531676290",
"length": 1798
},
"id": "CVE-2026-44512-a8590edb",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/onnx/onnx/commit/cd310408165ad47c3cd7eb2b86cb5b80aa2e4fdf",
"target": {
"file": "onnx/version_converter/adapters/group_normalization_20_21.h",
"function": "adapt_group_normalization_20_21"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"228482980704034311841881112017427892123",
"313113492615176522612031115208892423443",
"248786995833648257980172781186848371283",
"246570733654124817269849164109250010026"
],
"threshold": 0.9
},
"id": "CVE-2026-44512-ace6ea0b",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/onnx/onnx/commit/cd310408165ad47c3cd7eb2b86cb5b80aa2e4fdf",
"target": {
"file": "onnx/version_converter/adapters/upsample_9_8.h"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "114817379621298857684431652542429923093",
"length": 1378
},
"id": "CVE-2026-44512-b8b952a0",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/onnx/onnx/commit/cd310408165ad47c3cd7eb2b86cb5b80aa2e4fdf",
"target": {
"file": "onnx/version_converter/adapters/upsample_9_8.h",
"function": "adapt_upsample_9_8"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"122987191581484744870228771313101758869",
"112439734789665754584415671923011193668",
"52827899273836259619138873353551922247",
"284423084555354878356711735464034821631"
],
"threshold": 0.9
},
"id": "CVE-2026-44512-d082073f",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/onnx/onnx/commit/cd310408165ad47c3cd7eb2b86cb5b80aa2e4fdf",
"target": {
"file": "onnx/version_converter/adapters/cast_9_8.h"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "158745351729078729538856968311087854674",
"length": 662
},
"id": "CVE-2026-44512-fcdf2811",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/onnx/onnx/commit/cd310408165ad47c3cd7eb2b86cb5b80aa2e4fdf",
"target": {
"file": "onnx/version_converter/adapters/upsample_6_7.h",
"function": "adapt_upsample_6_7"
}
}
]
vanir_signatures_modified
"2026-08-12T15:14:59Z"