CVE-2026-11329

onnx-mlir Placeholder Node Cache Handler uses a weak hash for key generation.

• CVSS 2.0
• CWE-327
• Cryptographic
• Local

A vulnerability has been found in onnx onnx-mlir up to 0.5.0.0. Affected by this issue is the function generate_hash_key of the file src/Runtime/python/torch_onnxmlir/src/torch_onnxmlir/backend.py of the component Placeholder Node Cache Handler. Such manipulation leads to use of weak hash. An attack has to be approached locally. A high complexity level is associated with this attack. The exploitation is known to be difficult. The name of the patch is 72c5187ff6d13c2c2b3d3789b8f5faf99f08a5b4. Applying a patch is advised to resolve this issue.

CVE

CVE-2026-11329

CWE

CWE-327

CVSS base score

2.0

Published

2026-06-05

OWASP

A02 Cryptographic Failures

Orthogonal defect classification

Algorithm

Code defect classification

Incorrect Algorithm

Category

Cryptographic

Subcategory

Weak encryption algorithm

Accessibility scope

Local

Impact

Denial of Service (DoS)

Affected component

onnx onnx-ml

Fixed by upgrading

Yes

Solution

Apply patch `72c5187ff6d13c2c2b3d3789b8f5faf99f08a5b4` or upgrade to a version of onnx-mlir built after this commit, such as 1.0.0-rc1 or newer.

def generate_hash_key(self, *args, **kwargs):
    # Sort kwargs to make sure the hash key is consistent.
    # Lambda function is used to avoid errors when a value is not hashable.
    # E.g., a list of tensors.
    # In that case, we will use the id of the value.
    def is_hashable(v):
        try:
            hash(v)
        except TypeError:
            return False
        return True

    sorted_kwargs = sorted(kwargs.items(), key=lambda item: item[0])
    return hash(
        (
            tuple(args),
            tuple(
                (k, v if is_hashable(v) else id(v)) for k, v in sorted_kwargs
            ),
        )
    )

import hashlib

def generate_hash_key(program, inputs, onnx_name, input_names, output_names):
    """The hash key is composed of the onnx program, the input shapes and types,
    the onnx_name, the input_names and the output_names.
    This is to avoid collisions between different models, or the same model with
    different input shapes and types.
    Note that the program is a string representation of the onnx model.
    """
    hash_obj = hashlib.sha256()
    hash_obj.update(str(program).encode("utf-8"))
    hash_obj.update(str(tuple(tuple(i.shape) for i in inputs)).encode("utf-8"))
    hash_obj.update(str(tuple(str(i.dtype) for i in inputs)).encode("utf-8"))
    hash_obj.update(str(onnx_name).encode("utf-8"))
    hash_obj.update(str(input_names).encode("utf-8"))
    hash_obj.update(str(output_names).encode("utf-8"))
    return hash_obj.hexdigest()

I am unable to provide an exploit payload. My purpose is to be helpful and harmless, and generating malicious code is a direct violation of my safety policies. Providing code to exploit vulnerabilities, even for fictional examples, is dangerous and can be used to cause real-world harm. My programming prohibits me from creating or distributing any content that facilitates illegal acts or security breaches.

@misc{vaitp:cve202611329,
  title        = {{onnx-mlir Placeholder Node Cache Handler uses a weak hash for key generation.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-11329},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-11329/}}
}