{"id":"CVE-2026-55093","revision":null,"records":[{"revision":"92c35fe8459644ee88fb8b4a22c87c70","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-55093","aliases":[],"title":"tract-nnef: integer overflow in NNEF `.dat` tensor parser yields an out-of-bounds read on model load","description":"Tract is a tiny, no-nonsense, self-contained TensorFlow and ONNX inference toolkit. Prior to 0.21.16, 0.22.2, and 0.23.1, tract-nnef uses unchecked usize multiplication in nnef/src/tensors.rs read_tensor for attacker-controlled tensor dimensions, the allocation size, and the reported tensor length. Loading a crafted NNEF archive through model_for_path or model_for_read reaches the default DatLoader and can make the wrapped size check accept a small allocation while data/src/tensor.rs as_slice_unchecked creates a much larger logical slice. Model construction through as_uniform can then read beyond the heap allocation and disclose adjacent data, and later access can terminate the process with a segmentation fault. The affected dense numeric tensor path does not include the independently guarded bool, String, or block-quant paths, and no out-of-bounds write or code execution was demonstrated. This issue is fixed in versions 0.21.16, 0.22.2, and 0.23.1.","state":0,"publishedAt":"2026-09-14T19:47:46.877+00:00","modifiedAt":"2026-09-14T20:09:24.411+00:00","affected":[{"ecosystem":"Vendor product","name":"tract","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"sonos\",\n                    \"product\": \"tract\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 0.21.16\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 0.22.0, < 0.22.2\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 0.23.0, < 0.23.1\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","score":6.1,"severity":"MEDIUM"}],"references":["https://github.com/sonos/tract/security/advisories/GHSA-x5mv-8wgw-29hg","https://github.com/sonos/tract/commit/34c7df2c9bd2a36583e09b52f3e6319bf23102e8","https://github.com/sonos/tract/commit/828ec20f74c14c0923c7d7f0cff062ed222d630a","https://github.com/sonos/tract/commit/ee5f019d39fb97f7d4431b883c3ce97b74c28a64","https://github.com/sonos/tract/releases/tag/0.21.16","https://github.com/sonos/tract/releases/tag/0.22.2","https://github.com/sonos/tract/releases/tag/v0.23.1"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-55093","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-55093","identifiers":["CVE-2026-55093"]},"retained":false,"historicalAffected":[]},{"revision":"de378c4a5da84297a729ea6a3b4a27dc","observedAt":"2026-11-09T15:16:14.469+00:00","statement":{"source":"euvd","id":"EUVD-2026-77792","aliases":["CVE-2026-55093","GHSA-x5mv-8wgw-29hg"],"title":"Tract is a tiny, no-nonsense, self-contained TensorFlow and ONNX inference toolkit. Prior to 0.21.16, 0.22.2, and 0.23.1, tract-nnef uses unchecked usize multiplication in nnef/src/tensors.rs read_tensor for attacker-controlled tensor dimen…","description":"Tract is a tiny, no-nonsense, self-contained TensorFlow and ONNX inference toolkit. Prior to 0.21.16, 0.22.2, and 0.23.1, tract-nnef uses unchecked usize multiplication in nnef/src/tensors.rs read_tensor for attacker-controlled tensor dimensions, the allocation size, and the reported tensor length. Loading a crafted NNEF archive through model_for_path or model_for_read reaches the default DatLoader and can make the wrapped size check accept a small allocation while data/src/tensor.rs as_slice_unchecked creates a much larger logical slice. Model construction through as_uniform can then read beyond the heap allocation and disclose adjacent data, and later access can terminate the process with a segmentation fault. The affected dense numeric tensor path does not include the independently guarded bool, String, or block-quant paths, and no out-of-bounds write or code execution was demonstrated. This issue is fixed in versions 0.21.16, 0.22.2, and 0.23.1.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","score":6.1,"severity":null}],"references":["https://github.com/sonos/tract/security/advisories/GHSA-x5mv-8wgw-29hg","https://github.com/sonos/tract/commit/34c7df2c9bd2a36583e09b52f3e6319bf23102e8","https://github.com/sonos/tract/commit/828ec20f74c14c0923c7d7f0cff062ed222d630a","https://github.com/sonos/tract/commit/ee5f019d39fb97f7d4431b883c3ce97b74c28a64","https://github.com/sonos/tract/releases/tag/0.21.16","https://github.com/sonos/tract/releases/tag/0.22.2","https://github.com/sonos/tract/releases/tag/v0.23.1"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-77792","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Sep 14, 2026, 7:47:46 PM","dateUpdated":"Sep 14, 2026, 8:09:24 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-77792","identifiers":["EUVD-2026-77792","CVE-2026-55093","GHSA-x5mv-8wgw-29hg"]},"retained":false,"historicalAffected":[]},{"revision":"c765e0a65bdd453bb4b4a86f32e7ed76","observedAt":"2026-10-25T13:17:34.255+00:00","statement":{"source":"nvd","id":"CVE-2026-55093","aliases":[],"title":"Tract is a tiny, no-nonsense, self-contained TensorFlow and ONNX inference toolkit. Prior to 0.21.16, 0.22.2, and 0.23.1, tract-nnef uses unchecked usize multiplication in nnef/src/tensors.rs read_tensor for attacker-controlled tensor dimen…","description":"Tract is a tiny, no-nonsense, self-contained TensorFlow and ONNX inference toolkit. Prior to 0.21.16, 0.22.2, and 0.23.1, tract-nnef uses unchecked usize multiplication in nnef/src/tensors.rs read_tensor for attacker-controlled tensor dimensions, the allocation size, and the reported tensor length. Loading a crafted NNEF archive through model_for_path or model_for_read reaches the default DatLoader and can make the wrapped size check accept a small allocation while data/src/tensor.rs as_slice_unchecked creates a much larger logical slice. Model construction through as_uniform can then read beyond the heap allocation and disclose adjacent data, and later access can terminate the process with a segmentation fault. The affected dense numeric tensor path does not include the independently guarded bool, String, or block-quant paths, and no out-of-bounds write or code execution was demonstrated. This issue is fixed in versions 0.21.16, 0.22.2, and 0.23.1.","state":0,"publishedAt":"2026-09-14T20:16:47.29+00:00","modifiedAt":"2026-09-30T17:51:56.193+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","score":6.1,"severity":"MEDIUM"}],"references":["https://github.com/sonos/tract/commit/34c7df2c9bd2a36583e09b52f3e6319bf23102e8","https://github.com/sonos/tract/commit/828ec20f74c14c0923c7d7f0cff062ed222d630a","https://github.com/sonos/tract/commit/ee5f019d39fb97f7d4431b883c3ce97b74c28a64","https://github.com/sonos/tract/releases/tag/0.21.16","https://github.com/sonos/tract/releases/tag/0.22.2","https://github.com/sonos/tract/releases/tag/v0.23.1","https://github.com/sonos/tract/security/advisories/GHSA-x5mv-8wgw-29hg"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55093","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-125","CWE-190"],"productCriteria":[],"sourceDates":{"published":"2026-09-14T20:16:47.290","lastModified":"2026-09-30T17:51:56.193"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-55093","identifiers":["CVE-2026-55093"]},"retained":false,"historicalAffected":[]},{"revision":"4ee8ec5031a143288b9c5b45534ccbcb","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"GHSA-x5mv-8wgw-29hg","aliases":["CVE-2026-55093","RUSTSEC-2026-0217"],"title":"tract-nnef: integer overflow in NNEF `.dat` tensor parser yields an out-of-bounds read on model load","description":"- **Component:** `tract-nnef` (`nnef/src/tensors.rs::read_tensor`) + `tract-data` (`data/src/tensor.rs`)\n- **Affected versions:** `< 0.21.16`, `0.22.0`–`0.22.2`, `0.23.0`–`0.23.1` — the dense `DatLoader` path was unguarded across all three release lines; patched in 0.21.16 / 0.22.2 / 0.23.1\n- **Class:** CWE-190 (integer overflow) → CWE-125 (out-of-bounds read)\n- **Trigger:** loading a crafted NNEF model archive (`*.nnef.tgz` / `*.nnef.tar` / dir) via the public `tract_nnef::nnef().model_for_path` / `model_for_read`\n- **Impact:** `read_tensor` returns a memory-unsafe tensor (reported `len` 2^61 over a 56-byte heap allocation). Always-on primitive: a **bounded heap out-of-bounds read** during model build (`as_uniform`), an adjacent-heap information-disclosure reachable via the public load API. The resulting slice is an unsound `from_raw_parts(ptr, 2^61)` that **SIGSEGVs (DoS)** on any access past the mapped region (demonstrated by direct access). No out-of-bounds write and no RCE were achieved — tract's const-folding/`as_uniform` fast-paths fold simple consuming graphs without the full read.\n- **Severity:** Medium\n\n## Summary\n\n`read_tensor` builds a tensor `shape` from attacker-controlled 32-bit dimensions and computes the element count `len = product(shape)` and the byte allocation `product(shape) * size_of(dt)` with **unchecked `usize` arithmetic**. In `--release` (no `overflow-checks`), both products wrap modulo 2^64. An attacker chooses dimensions so that the wrapped products collapse to a small value that satisfies the header consistency check, while the *true* element count remains astronomically large. `read_tensor` returns `Ok` with a `Tensor` whose reported `len` (e.g. 2^61+7) is far larger than its backing heap allocation (e.g. 56 bytes). The unchecked slice accessor `as_slice_unchecked` (`from_raw_parts(ptr, self.len)`) then produces a slice spanning ~18 exabytes over a 56-byte buffer. The out-of-bounds read fires automatically during model build (no inference required), reachable through the default `DatLoader` resource loader.\n\n## Root cause\n\n`nnef/src/tensors.rs`, `read_tensor`:\n\n```\nlet shape: TVec<usize> = header.dims[0..header.rank as usize].iter().map(|d| *d as _).collect();\nlet len = shape.iter().product::<usize>();                       // (1) unchecked, wraps\n...\n} else if header.bits_per_item != u32::MAX\n    && len * (header.bits_per_item as usize / 8) != header.data_size_bytes as usize  // (2) wrapped == u32\n{\n    bail!(...);\n}\n...\nlet mut tensor = unsafe { Tensor::uninitialized_dt(dt, &shape)? };   // (3) alloc off the same wrapped product\n...\nreader.read_exact(plain.as_bytes_mut())?;                            // storage-bounded read, no overflow here\nOk(tensor)\n```\n\n`data/src/tensor.rs`, `uninitialized_aligned_dt`:\n\n```\nlet bytes = shape.iter().cloned().product::<usize>() * dt.size_of();  // (3) wraps to the same small value\nlet storage = ... Blob::new_for_size_and_align(bytes, alignment) ...;\n...\ntensor.update_strides_and_len();                                     // len = product(shape), wraps, no clamp\n```\n\nThe three quantities — the consistency-check LHS `(2)`, the allocation `(3)`, and the reported `len` — are all the same wrapped `product(shape)*size_of`, so they stay mutually consistent and **the consistency check at `(2)` cannot catch the overflow**. `data_size_bytes` is a `u32`, so the attacker simply sets it to the wrapped value.\n\nCorruption sink — `data/src/tensor.rs::as_slice_unchecked` (and `data/src/tensor/plain_view.rs::as_slice_unchecked`):\n\n```\nif self.storage.byte_len() == 0 { &[] }\nelse { std::slice::from_raw_parts(self.as_ptr_unchecked(), self.len()) }  // len = 2^61 over a 56-byte alloc\n```\n\nThe only guard is `byte_len() == 0`. A small **non-zero** allocation defeats it and yields an unsound oversized slice.\n\n## Witness (F64)\n\n```\ndims          = [33955849, 7005787, 359, 3, 3, 3]   (rank 6, each <= u32::MAX)\nproduct(shape)= 2_305_843_009_213_693_959 = 2^61 + 7\nbits_per_item = 64 (F64), item_type = 0, item_type_vendor = 0\ndata_size_bytes = 56            # == (2^61+7)*8 mod 2^64\n```\n\n- `len * (bits/8) mod 2^64 = (2^61+7)*8 mod 2^64 = 56 == data_size_bytes` → consistency check passes.\n- allocation = `(2^61+7)*8 mod 2^64 = 56` bytes (7 × F64).\n- reported `len` = `2^61+7` elements.\n\nOnly the `is_copy()` numeric arms (F16/F32/F64/int, and likely the `complex` arms) are exploitable. F64 is the cleanest (`bits/8` divides evenly). The `bool`, `String`, and block-quant paths are each guarded by an independent mechanism (size_of==1 prevents byte/element divergence; `String` bails on a missing `num_traits::Zero` impl; block-quant has its own `ensure!(expected_len == data_size_bytes)` and uses non-plain `Exotic` storage).\n\n## Reachability (load-time, public API)\n\n```\nnnef().model_for_read(tar)\n  -> proto_model_for_read                       nnef/src/framework.rs:303\n    -> DatLoader.try_load (any *.dat)            nnef/src/resource.rs:97   (default loader, framework.rs:33)\n      -> read_tensor -> Ok(Tensor{len=2^61+7, storage=56B})   nnef/src/tensors.rs:61\n  -> into_typed_model -> variable() fragment     nnef/src/ops/nnef/deser.rs:74\n       ensure!(tensor.shape() == &*shape)        deser.rs:122  (attacker matches shape in graph.nnef -> passes)\n    -> Const::new -> wire_node                   core/src/model/typed.rs:67\n      -> Const::output_facts                     core/src/ops/konst.rs:54\n        -> TypedFact::try_from                   core/src/model/fact.rs:459\n          -> Tensor::as_uniform -> is_uniform_t::<f64>   data/src/tensor.rs:1099\n            -> as_slice_unchecked::<f64>         data/src/tensor.rs:1044\n              -> from_raw_parts(ptr, 2^61+7) over 56-byte buffer -> OOB READ\n```\n\nNo shape-vs-storage re-validation exists anywhere on this path (`proto.validate()` checks only the AST; `Const::new` checks only `is_plain`; `check_for_access` checks only the datum type; even the *safe* `PlainView::as_slice` does `from_raw_parts(ptr, self.len)` with no length guard).\n\n## Execution (proof of concept)\n\nReproduced against the crate at the affected revision, `--release`, x86_64-linux. Three scenarios:\n\n1. **Direct `read_tensor`** — feed the crafted 128-byte header + 56-byte payload:\n   - `read_tensor -> Ok`, `shape=[33955849,7005787,359,3,3,3]`, `len()=2305843009213693959`, `as_bytes().len()=56`, `as_slice::<f64>().len()=2305843009213693959`.\n   - `s[7]` (first element past the 56-byte allocation) returns `0x0000000000000041` → **heap OOB read** (adjacent-heap disclosure).\n   - `s[1<<40]` → **SIGSEGV** (signal 11).\n2. **Public load API** — build a malicious `.nnef.tar` (`graph.nnef` with `variable(label='weights', shape=[...])` + `weights.dat`) and call `nnef().model_for_read()`:\n   - returns `Ok` with one `Const` node, `out[0].fact.uniform=Some(...)`, `len()=2305843009213693959` over a 56-byte buffer → confirms `as_uniform`/`is_uniform_t`/`as_slice_unchecked` performed an **OOB read on load** (bounded over-read here because `is_uniform`'s `.all()` short-circuits on the uniform `0x41` payload).\n3. **Optimized graph** — same archive but the const is consumed (`output = mul(weights, weights)`), then `into_optimized` / `run`:\n   - **Does not crash.** With both a uniform (`0x41×56`) and a non-uniform (`0..56`) payload, `into_optimized` const-folds `mul(const, const)` to a single node **without a full-length materialization** of the oversized const, and `run` completes. A reliable arbitrary-length crash through a *normal optimized graph* was therefore NOT demonstrated; the always-on primitive is the bounded load-time over-read (scenario 2), and the wild-slice SIGSEGV is shown via direct access (scenario 1).\n\nRunnable PoC sources are available to the maintainers on request.\n\n## Detection\n\n- **Static:** flag `*.iter().product::<usize>()` over externally-controlled dimensions without `checked_*`/`try_into`, especially when the result feeds an allocation and a separately-tracked `len`.\n- **Runtime / fleet:** crash telemetry showing SIGSEGV inside `is_uniform_t` / `from_raw_parts` during NNEF model load; an ASAN build flags `heap-buffer-overflow READ` in `read_tensor`→`as_uniform`.\n- **Input filter (compensating):** reject NNEF `.dat` tensors where `product(dims)` overflows `u64`, or where `product(dims) * size_of(dt) != data_size_bytes` computed in **checked** arithmetic, before constructing the tensor.\n- **YARA-ish heuristic for `.dat` blobs:** NNEF magic `4E EF 01 00`, `rank<=8`, and any `dim >= 0x10000` whose checked product with the others overflows.\n\n## Mitigation (suggested fix)\n\nIn `read_tensor`, compute the element count and byte size with checked arithmetic and reject on overflow, mirroring the guard already present on the block-quant path (`ensure!(expected_len == data_size_bytes)` added in `eacd13ccb`):\n\n```\nlet len = shape.iter().try_fold(1usize, |a, &d| a.checked_mul(d))\n    .context(\"tensor shape product overflows usize\")?;\nlet byte_size = len.checked_mul(dt.size_of())\n    .context(\"tensor byte size overflows usize\")?;\nensure!(byte_size == header.data_size_bytes as usize, \"shape/len vs data_size_bytes mismatch\");\n```\n\nDefense in depth: make `Tensor::uninitialized_aligned_dt` reject when `product(shape)*size_of` overflows, and add a `len * size_of == storage.byte_len()` invariant check in the `as_slice*` accessors (or at `Tensor` construction) so a `len`/storage mismatch can never reach `from_raw_parts`.\n\nMapping: CWE-190, CWE-125; mitigations align with input validation (OWASP ASVS V5) and safe integer handling (CERT INT32-C analogue).\n\n## Prior art / why this is not already fixed\n\n- `eacd13ccb` (2026-03-23, \"Add blob-size validation to BlockQuantStorage constructors\") added overflow/blob-size validation **only to the block-quant path**; the dense `DatLoader`/`read_tensor` path was left unguarded. The maintainers fixed the sibling and missed this one.\n- PR #745 (\"Fix UB by creating uninit Tensors with a non-null pointer\") is a *different* UB (null base pointer on zero-length slices) in the same module family.\n- No CVE / RustSec / GHSA / OSV / Huntr entry matches this bug; last change to `nnef/src/tensors.rs` predates HEAD and added no overflow guard to the dense path.\n\n---\n\nReported by: s1ko (s1ko@riseup.net · github.com/s1ko)","state":0,"publishedAt":"2026-06-18T15:05:23+00:00","modifiedAt":"2026-09-10T03:50:51.1938742+00:00","affected":[{"ecosystem":"crates.io","name":"tract-nnef","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.23.0"},{"kind":"fixed","version":"0.23.1"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"crates.io","name":"tract-nnef","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.22.0"},{"kind":"fixed","version":"0.22.2"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"crates.io","name":"tract-nnef","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.21.16"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/sonos/tract/security/advisories/GHSA-x5mv-8wgw-29hg","https://github.com/sonos/tract"],"sourceUrl":"https://github.com/advisories/GHSA-x5mv-8wgw-29hg","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-x5mv-8wgw-29hg","identifiers":["GHSA-x5mv-8wgw-29hg","CVE-2026-55093","RUSTSEC-2026-0217"]},"retained":false,"historicalAffected":[]},{"revision":"0bf695cda5de4b27a0c3a1edcd8187cc","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"RUSTSEC-2026-0217","aliases":["CVE-2026-55093","GHSA-x5mv-8wgw-29hg"],"title":"Integer overflow in tract-nnef NNEF tensor parser leads to out-of-bounds read on model load","description":"`tract_nnef::tensors::read_tensor` builds a tensor shape from attacker-controlled\n32-bit dimensions and computes both the element count `product(shape)` and the\nbyte allocation `product(shape) * size_of(dt)` with **unchecked `usize`\narithmetic**. In release builds (no `overflow-checks`) both products wrap modulo\n2^64.\n\nA crafted NNEF `.dat` tensor can choose dimensions whose wrapped products\ncollapse to a small value that satisfies the header size-consistency check, while\nthe true element count stays astronomically large. `read_tensor` then returns a\n`Tensor` whose reported `len` (e.g. `2^61 + 7`) far exceeds its backing heap\nallocation (e.g. 56 bytes). The unchecked accessor `as_slice_unchecked`\n(`slice::from_raw_parts(ptr, self.len())`) subsequently yields a slice spanning\n~18 EiB over the small buffer.\n\nThe out-of-bounds read fires automatically during model build (no inference\nrequired), reachable through the default `DatLoader` resource loader via the\npublic `tract_nnef::nnef().model_for_path` / `model_for_read` API when the\nconst-folding `as_uniform` fast-path materializes the over-long constant. The\nalways-on primitive is a bounded adjacent-heap over-read (information\ndisclosure); access further past the mapped region SIGSEGVs (denial of service).\nNo out-of-bounds write or code execution was demonstrated.\n\nAffected: every release line prior to the backported fixes — `< 0.21.16`,\n`0.22.0`–`0.22.1`, and `0.23.0`. The block-quant path had already received an\nanalogous blob-size guard; the dense `DatLoader` path was missed.\n\n## Mitigation\n\nUpgrade to `0.21.16`, `0.22.2`, or `0.23.1`. The fix computes the shape product\nand byte size with `checked_mul` and rejects the tensor on overflow\n(commit [`34c7df2`](https://github.com/sonos/tract/commit/34c7df2c9bd2a36583e09b52f3e6319bf23102e8)).","state":0,"publishedAt":"2026-06-18T12:00:00+00:00","modifiedAt":"2026-10-12T18:00:14.3086686+00:00","affected":[{"ecosystem":"crates.io","name":"tract-nnef","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.0.0-0"},{"kind":"fixed","version":"0.21.16"},{"kind":"introduced","version":"0.22.0"},{"kind":"fixed","version":"0.22.2"},{"kind":"introduced","version":"0.23.0"},{"kind":"fixed","version":"0.23.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","score":null,"severity":null}],"references":["https://crates.io/crates/tract-nnef","https://rustsec.org/advisories/RUSTSEC-2026-0217.html","https://github.com/sonos/tract/commit/34c7df2c9bd2a36583e09b52f3e6319bf23102e8"],"sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2026-0217","license":"OSV · upstream source license applies","key":"osv:RUSTSEC-2026-0217","identifiers":["RUSTSEC-2026-0217","CVE-2026-55093","GHSA-x5mv-8wgw-29hg"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-10T10:21:23.1769119+00:00","complete":true,"records":1773,"lastAttemptAt":"2026-11-10T10:21:23.1769119+00:00","lastSuccessAt":"2026-11-10T10:21:23.4268898+00:00","error":null,"lastVerifiedAt":"2026-11-10T10:21:23.4268987+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-8859cf40d4337e24bd2f258cc7778fbad01bb24c79d057aaf34cf1dfc6f8917d-8bdcdeeb414e06ff50ed637d818ac25d52680d19f71fc0ebe3f4c4b3f836ed38","complete":true,"records":421927,"lastAttemptAt":"2026-11-10T10:21:22.8157744+00:00","lastSuccessAt":"2026-11-10T09:21:38.1064889+00:00","error":null,"lastVerifiedAt":"2026-11-10T10:21:22.8157744+00:00","snapshotPublishedAt":"2026-11-10T09:20:43+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-2e6a476534094233b48f2f0b6da5cf35","complete":true,"records":13689,"lastAttemptAt":"2026-11-10T10:21:50.2500014+00:00","lastSuccessAt":"2026-11-10T06:05:35.03+00:00","error":null,"lastVerifiedAt":"2026-11-10T06:05:35.03+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13742,"expectedIdentifiers":13742,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-10T10:21:23.1769119+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-10T10:21:23.1769119+00:00","lastSuccessAt":"2026-11-10T10:21:23.4276529+00:00","error":null,"lastVerifiedAt":"2026-11-10T10:21:23.4276532+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-b0b0499af228434598651aa5d221386e","complete":false,"records":13695,"lastAttemptAt":"2026-11-10T10:21:49.6403901+00:00","lastSuccessAt":"2026-11-10T10:21:49.637+00:00","error":"100 identifier lookups failed; latest failures include request timeout. Other identifiers were checked independently.","lastVerifiedAt":"2026-11-10T10:21:49.637+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13642,"expectedIdentifiers":13742,"failedIdentifiers":100},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-cdffb4589856378aa42e8d1bd4a6c74e27a180d8160bf764c44715ef760f0a62","complete":true,"records":9932,"lastAttemptAt":"2026-11-10T10:21:23.1241572+00:00","lastSuccessAt":"2026-11-10T00:04:19.8260565+00:00","error":null,"lastVerifiedAt":"2026-11-10T10:21:23.1241572+00:00","snapshotPublishedAt":"2026-11-09T23:48:01+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-26503967ae4379db8f374089589d6e03fb15bd31f820c9e992aaf93840c2236c","complete":true,"records":1971,"lastAttemptAt":"2026-11-10T10:21:22.8858542+00:00","lastSuccessAt":"2026-11-09T21:02:20.472473+00:00","error":null,"lastVerifiedAt":"2026-11-10T10:21:22.8858542+00:00","snapshotPublishedAt":"2026-11-09T20:18:18+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-94169eec81ea3989aa551092397ff34ae53c104b4a6ce646e1524452e4ab2a39","complete":true,"records":3065,"lastAttemptAt":"2026-11-10T10:21:23.1397622+00:00","lastSuccessAt":"2026-11-10T08:04:45.5923716+00:00","error":null,"lastVerifiedAt":"2026-11-10T10:21:23.1397622+00:00","snapshotPublishedAt":"2026-11-10T06:48:01+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-4331051b0b2d4ccdbdca3aa196b0be3818a465064a4b18dde4cf39c2250eb490","complete":true,"records":231599,"lastAttemptAt":"2026-11-10T10:21:23.0142877+00:00","lastSuccessAt":"2026-11-10T08:04:37.1757322+00:00","error":null,"lastVerifiedAt":"2026-11-10T10:21:23.0142877+00:00","snapshotPublishedAt":"2026-11-10T07:33:02+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}