ONNX Patches Denial-of-Service Flaw in Sub-Byte Tensor Handling

ONNX disclosed CVE-2026-115922, a medium-severity denial-of-service vulnerability affecting all versions through 1.21.0, patched in version 1.22.0¹. The flaw allowed a crafted model as small as 66 bytes to trigger approximately 700 MB of memory allocation by declaring 700 million elements backed by a single packed byte. The vulnerable _unpack_2bit() and _unpack_4bit() code paths resized arrays to attacker-controlled dimensions without verifying the packed payload contained enough logical elements. Affected tensor types include UINT2, INT2, UINT4, INT4, and FLOAT4E2M1 stored in raw_data or packed int32_data.