Unrated

DEBIAN-CVE-2026-34445

Type: advisorySource: OSV1 source record

Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, the ExternalDataInfo class in ONNX was using Python’s setattr() function to load metadata (like file paths or data lengths) directly from an ONNX model file. It didn’t check if the "keys" in the file were valid. Due to this, an attacker could craft a malicious model that overwrites internal object properties. This issue has been patched in version 1.21.0.

Announced 1 Apr 2026Group revision 1

Original source ↗

DEBIAN-CVE-2026-34445

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:DEBIAN-CVE-2026-34445

onnx

Source reference: /affected/0/package/name

Affected versions: 1.12.0-2
Source reference: /affected/0/versions
1.13.1-1
Source reference: /affected/0/versions
1.13.1-2
Source reference: /affected/0/versions
1.13.1-3
Source reference: /affected/0/versions
1.14.1-1
Source reference: /affected/0/versions
1.14.1-2
Source reference: /affected/0/versions
1.14.1-2.1
Source reference: /affected/0/versions
1.14.1-2.1~exp1
Source reference: /affected/0/versions
1.16.1-1
Source reference: /affected/0/versions
1.16.2-1
Source reference: /affected/0/versions
1.17.0-1
Source reference: /affected/0/versions
1.17.0-2
Source reference: /affected/0/versions
1.17.0-3
Source reference: /affected/0/versions
1.19.1-1~exp1
Source reference: /affected/0/versions
1.20.0-1
Source reference: /affected/0/versions
1.20.0-1~exp1
Source reference: /affected/0/versions
1.20.0-3
Source reference: /affected/0/versions
1.20.0-4
Source reference: /affected/0/versions
1.20.0-5
Source reference: /affected/0/versions
1.20.0-6
Source reference: /affected/0/versions
1.21.0-1
Source reference: /affected/0/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

onnx

Source reference: /affected/1/package/name

Affected versions: 1.17.0-3
Source reference: /affected/1/versions
1.19.1-1~exp1
Source reference: /affected/1/versions
1.20.0-1
Source reference: /affected/1/versions
1.20.0-1~exp1
Source reference: /affected/1/versions
1.20.0-3
Source reference: /affected/1/versions
1.20.0-4
Source reference: /affected/1/versions
1.20.0-5
Source reference: /affected/1/versions
1.20.0-6
Source reference: /affected/1/versions
1.21.0-1
Source reference: /affected/1/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

onnx

Source reference: /affected/2/package/name

Affected versions: 1.17.0-3
Source reference: /affected/2/versions
1.19.1-1~exp1
Source reference: /affected/2/versions
1.20.0-1
Source reference: /affected/2/versions
1.20.0-1~exp1
Source reference: /affected/2/versions
1.20.0-3
Source reference: /affected/2/versions
1.20.0-4
Source reference: /affected/2/versions
1.20.0-5
Source reference: /affected/2/versions
1.20.0-6
Source reference: /affected/2/versions
1.21.0-1
Source reference: /affected/2/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "onnx",
      "purl": "pkg:deb/debian/onnx?arch=source&distro=bookworm",
      "ecosystem": "Debian:12"
    },
    "versions": [
      "1.12.0-2",
      "1.13.1-1",
      "1.13.1-2",
      "1.13.1-3",
      "1.14.1-1",
      "1.14.1-2",
      "1.14.1-2.1",
      "1.14.1-2.1~exp1",
      "1.16.1-1",
      "1.16.2-1",
      "1.17.0-1",
      "1.17.0-2",
      "1.17.0-3",
      "1.19.1-1~exp1",
      "1.20.0-1",
      "1.20.0-1~exp1",
      "1.20.0-3",
      "1.20.0-4",
      "1.20.0-5",
      "1.20.0-6",
      "1.21.0-1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-34445.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "onnx",
      "purl": "pkg:deb/debian/onnx?arch=source&distro=trixie",
      "ecosystem": "Debian:13"
    },
    "versions": [
      "1.17.0-3",
      "1.19.1-1~exp1",
      "1.20.0-1",
      "1.20.0-1~exp1",
      "1.20.0-3",
      "1.20.0-4",
      "1.20.0-5",
      "1.20.0-6",
      "1.21.0-1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-34445.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "onnx",
      "purl": "pkg:deb/debian/onnx?arch=source&distro=forky",
      "ecosystem": "Debian:14"
    },
    "versions": [
      "1.17.0-3",
      "1.19.1-1~exp1",
      "1.20.0-1",
      "1.20.0-1~exp1",
      "1.20.0-3",
      "1.20.0-4",
      "1.20.0-5",
      "1.20.0-6",
      "1.21.0-1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-34445.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  }
]

Publisher severity

No explicit severity was provided.

Event: #56377 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 16:35:42 GMT
Publisher date: Wed, 01 Apr 2026 18:16:30 GMT

Read the original announcement

Revision history

25 Oct 2026DEBIAN-CVE-2026-34445 · Revision 1Source updated