{"action":"Upgrade tract-nnef to 0.21.16 or later.","affected":[{"fixed":"0.21.16","introduced":"0.0.0-0"},{"fixed":"0.22.2","introduced":"0.22.0"},{"fixed":"0.23.1","introduced":"0.23.0"}],"component":"tract-nnef","cve_ids":["CVE-2026-55093"],"ecosystem":"crates.io","epss":0.00181,"exploited":false,"fixed_versions":["0.21.16","0.22.2","0.23.1"],"ghsa_id":"GHSA-x5mv-8wgw-29hg","id":"tcs_01M5KFBW12FM4JKAHWJ84H4686","modified_at":"2026-10-12T18:00:14.308668573Z","published_at":"2026-06-18T12:00:00Z","references":["https://osv.dev/vulnerability/RUSTSEC-2026-0217","https://crates.io/crates/tract-nnef","https://rustsec.org/advisories/RUSTSEC-2026-0217.html","https://github.com/sonos/tract/commit/34c7df2c9bd2a36583e09b52f3e6319bf23102e8"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"RUSTSEC-2026-0217","url":"https://osv.dev/vulnerability/RUSTSEC-2026-0217"}],"summary":"Integer overflow in tract-nnef NNEF tensor parser leads to out-of-bounds read on model load"}