CVE-2026-11329

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-11329", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-06-05T06:43:25.150Z", "datePublished": "2026-06-05T12:15:11.835Z", "dateUpdated": "2026-06-08T17:03:42.507Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-06-05T12:15:11.835Z"}, "title": "onnx onnx-mlir Placeholder Node Cache backend.py generate_hash_key weak hash", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-328", "lang": "en", "description": "Use of Weak Hash"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-327", "lang": "en", "description": "Risky Cryptographic Algorithm"}]}], "affected": [{"vendor": "onnx", "product": "onnx-mlir", "versions": [{"version": "0.5.0", "status": "affected"}], "cpes": ["cpe:2.3:a:onnx:onnx-mlir:*:*:*:*:*:*:*:*"], "modules": ["Placeholder Node Cache Handler"]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in onnx onnx-mlir up to 0.5.0.0. Affected by this issue is the function generate_hash_key of the file src/Runtime/python/torch_onnxmlir/src/torch_onnxmlir/backend.py of the component Placeholder Node Cache Handler. Such manipulation leads to use of weak hash. An attack has to be approached locally. A high complexity level is associated with this attack. The exploitation is known to be difficult. The name of the patch is 72c5187ff6d13c2c2b3d3789b8f5faf99f08a5b4. Applying a patch is advised to resolve this issue."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 2, "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X", "baseSeverity": "LOW"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.6, "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C", "baseSeverity": "LOW"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.6, "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C", "baseSeverity": "LOW"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 2.4, "vectorString": "AV:L/AC:H/Au:S/C:N/I:P/A:P/E:ND/RL:OF/RC:C"}}], "timeline": [{"time": "2026-06-05T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-06-05T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-06-05T08:48:29.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Dem00 (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/vuln/368865", "name": "VDB-368865 | onnx onnx-mlir Placeholder Node Cache backend.py generate_hash_key weak hash", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/368865/cti", "name": "VDB-368865 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-11329", "name": "CVE-2026-11329 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/832358", "name": "Submit #832358 | onnx onnx-mlir v0.5.0.0 cache key collision", "tags": ["third-party-advisory"]}, {"url": "https://github.com/onnx/onnx-mlir/pull/3427", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/onnx/onnx-mlir/commit/72c5187ff6d13c2c2b3d3789b8f5faf99f08a5b4", "tags": ["patch"]}, {"url": "https://github.com/onnx/onnx-mlir/", "tags": ["product"]}], "tags": ["x_open-source"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-08T17:01:45.917951Z", "id": "CVE-2026-11329", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-08T17:03:42.507Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-11329", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-08T17:01:45.917951Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-08T17:03:08.344Z"}}], "cna": {"tags": ["x_open-source"], "title": "onnx onnx-mlir Placeholder Node Cache backend.py generate_hash_key weak hash", "credits": [{"lang": "en", "type": "reporter", "value": "Dem00 (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 2, "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.6, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.6, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 2.4, "vectorString": "AV:L/AC:H/Au:S/C:N/I:P/A:P/E:ND/RL:OF/RC:C"}}], "affected": [{"cpes": ["cpe:2.3:a:onnx:onnx-mlir:*:*:*:*:*:*:*:*"], "vendor": "onnx", "modules": ["Placeholder Node Cache Handler"], "product": "onnx-mlir", "versions": [{"status": "affected", "version": "0.5.0"}]}], "timeline": [{"lang": "en", "time": "2026-06-05T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-06-05T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-06-05T08:48:29.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/368865", "name": "VDB-368865 | onnx onnx-mlir Placeholder Node Cache backend.py generate_hash_key weak hash", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/368865/cti", "name": "VDB-368865 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-11329", "name": "CVE-2026-11329 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/832358", "name": "Submit #832358 | onnx onnx-mlir v0.5.0.0 cache key collision", "tags": ["third-party-advisory"]}, {"url": "https://github.com/onnx/onnx-mlir/pull/3427", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/onnx/onnx-mlir/commit/72c5187ff6d13c2c2b3d3789b8f5faf99f08a5b4", "tags": ["patch"]}, {"url": "https://github.com/onnx/onnx-mlir/", "tags": ["product"]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in onnx onnx-mlir up to 0.5.0.0. Affected by this issue is the function generate_hash_key of the file src/Runtime/python/torch_onnxmlir/src/torch_onnxmlir/backend.py of the component Placeholder Node Cache Handler. Such manipulation leads to use of weak hash. An attack has to be approached locally. A high complexity level is associated with this attack. The exploitation is known to be difficult. The name of the patch is 72c5187ff6d13c2c2b3d3789b8f5faf99f08a5b4. Applying a patch is advised to resolve this issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-328", "description": "Use of Weak Hash"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-327", "description": "Risky Cryptographic Algorithm"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-06-05T12:15:11.835Z"}}}, "cveMetadata": {"cveId": "CVE-2026-11329", "state": "PUBLISHED", "dateUpdated": "2026-06-08T17:03:42.507Z", "dateReserved": "2026-06-05T06:43:25.150Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-06-05T12:15:11.835Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:onnx:onnx-mlir:*:*:*:*:*:*:*:*"], "modules": ["Placeholder Node Cache Handler"], "product": "onnx-mlir", "vendor": "onnx", "versions": [{"status": "affected", "version": "0.5.0"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in onnx onnx-mlir up to 0.5.0.0. Affected by this issue is the function generate_hash_key of the file src/Runtime/python/torch_onnxmlir/src/torch_onnxmlir/backend.py of the component Placeholder Node Cache Handler. Such manipulation leads to use of weak hash. An attack has to be approached locally. A high complexity level is associated with this attack. The exploitation is known to be difficult. The name of the patch is 72c5187ff6d13c2c2b3d3789b8f5faf99f08a5b4. Applying a patch is advised to resolve this issue."}, {"lang": "es", "value": "Una vulnerabilidad ha sido encontrada en onnx onnx-mlir hasta 0.5.0.0. Afectada por este problema es la funci\u00f3n generate_hash_key del archivo src/Runtime/python/torch_onnxmlir/src/torch_onnxmlir/backend.py del componente Gestor de Cach\u00e9 de Nodos Marcadores de Posici\u00f3n. Dicha manipulaci\u00f3n conduce al uso de un hash d\u00e9bil. Un ataque debe ser abordado localmente. Un alto nivel de complejidad est\u00e1 asociado con este ataque. Se sabe que la explotaci\u00f3n es dif\u00edcil. El nombre del parche es 72c5187ff6d13c2c2b3d3789b8f5faf99f08a5b4. Se aconseja aplicar un parche para resolver este problema."}], "id": "CVE-2026-11329", "lastModified": "2026-10-26T11:10:00.157", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "HIGH", "accessVector": "LOCAL", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 2.4, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:H/Au:S/C:N/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 1.5, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.6, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 2.5, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.0, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-11329", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-08T17:01:45.917951Z", "version": "2.0.3"}}]}, "published": "2026-06-05T13:16:38.343", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/onnx/onnx-mlir/"}, {"source": "cna@vuldb.com", "url": "https://github.com/onnx/onnx-mlir/commit/72c5187ff6d13c2c2b3d3789b8f5faf99f08a5b4"}, {"source": "cna@vuldb.com", "url": "https://github.com/onnx/onnx-mlir/pull/3427"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-11329"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/832358"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/368865"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/368865/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-327"}, {"lang": "en", "value": "CWE-328"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.5.0"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "onnx-mlir", "source": "cna", "vendor": "onnx"}, "product": "onnx-mlir", "vendor": "onnx"}], "created": "2026-06-05T14:00:17.665263+00:00", "updated": "2026-06-05T15:15:26.702410+00:00", "vendors": ["onnx", "onnx$PRODUCT$onnx-mlir"]}