Is onnx affected by CVE-2026-34445?

PyPI onnx is affected in <1.21.0.

Is CVE-2026-34445 being exploited?

Not on the CISA KEV list. EPSS exploit probability is 0.3%.

high

CVE-2026-34445

Q: Is CVE-2026-34445 being exploited?

Not on the CISA KEV list. EPSS exploit probability is 0.3%.

PyPI · onnx

Summary

ONNX: Malicious ONNX models can crash servers by exploiting unprotected object settings.

Severity: high
EPSS: 0.3% (p20)
Also known as: GHSA-538c-55jv-c5g9
Published: 2026-04-01

References

https://github.com/onnx/onnx/security/advisories/GHSA-538c-55jv-c5g9
https://nvd.nist.gov/vuln/detail/CVE-2026-34445
https://github.com/onnx/onnx/pull/7751

Related advisories

CVE-2026-28500 — critical · PyPI/onnx
GHSA-q56x-g2fj-4rj6 — high · PyPI/onnx
CVE-2026-27489 — high · PyPI/onnx
CVE-2024-5187 — high · PyPI/onnx
CVE-2024-7776 — high · PyPI/onnx
CVE-2026-34447 — medium · PyPI/onnx
CVE-2026-34446 — medium · PyPI/onnx

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Check my repo

Summarize with AI

ChatGPT Claude Perplexity

Sources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.