An input validation vulnerability in the flow.Tensor.new_empty/flow.Tensor.new_ones/flow.Tensor.new_zeros component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input.
An input validation vulnerability in the flow.scatter/flow.scatter_add component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted indices.
An input validation vulnerability in the oneflow.index_add component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVE-2025-71006 is a medium-severity vulnerability in the oneflow.reshape component of OneFlow v0.9.0 that allows attackers to cause a Denial of Service (DoS) via a crafted input triggering a floating point exception. The flaw does not impact confidentiality or integrity but can disrupt availability by crashing the affected system. Exploitation requires no privileges but does require user interaction to supply the malicious input. No known exploits are currently reported in the wild. European organizations using OneFlow for machine learning or data processing could face service interruptions if targeted. Mitigation involves input validation and patching when available. Countries with significant AI and machine learning adoption, such as Germany, France, and the UK, are more likely to be affected.
CVE-2025-71005 is a medium-severity vulnerability in OneFlow v0.9.0, specifically in the oneflow.view component, where a floating point exception can be triggered by crafted input. This flaw allows unauthenticated attackers to cause a denial of service (DoS) condition, impacting availability without affecting confidentiality or integrity. Exploitation requires user interaction but no privileges, and no known exploits are currently in the wild. The vulnerability stems from improper handling of floating point operations leading to exceptions that crash or hang the application. European organizations using OneFlow for machine learning or data processing may face service disruptions if targeted. Mitigation involves input validation and patching once updates become available, as no official patch links are currently provided. Countries with significant AI and tech sectors, such as Germany, France, and the UK, are most likely to be affected due to higher adoption of such frameworks.
CVE-2025-71003 is a high-severity input validation vulnerability in the flow.arange() component of OneFlow v0.9.0 that allows remote attackers to cause a Denial of Service (DoS) without authentication or user interaction. The flaw arises from improper input validation, enabling crafted inputs to crash or hang the application, impacting availability. There are no known exploits in the wild yet, and no patches have been published. European organizations using OneFlow for machine learning or data processing workloads could face service disruptions if targeted. Mitigation involves restricting access to OneFlow services, input sanitization, and monitoring for anomalous usage patterns. Countries with significant AI and data science sectors, such as Germany, France, and the UK, are more likely to be affected due to higher adoption rates of such frameworks. The vulnerability has a CVSS score of 7.
CVE-2025-71004 is a medium-severity vulnerability in the oneflow.logical_or component of OneFlow v0.9.0 that allows attackers to cause a Denial of Service (DoS) via crafted input. The flaw is a segmentation violation related to memory safety issues such as null pointer dereference or out-of-bounds access. Exploitation requires network access and user interaction but no privileges. The impact is limited to availability disruption without compromising confidentiality or integrity. No known exploits are currently reported in the wild. European organizations using OneFlow for machine learning or data processing could experience service interruptions if targeted. Mitigation involves input validation, patching when available, and restricting access to vulnerable services.
A GPU device-ID validation flaw in the flow.cuda.get_device_capability() component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted device ID.
A GPU device-ID validation flaw in OneFlow v0.9.0 allows attackers to trigger a Denial of Dervice (DoS) by invoking flow.cuda.get_device_properties() with an invalid or negative device index.
A device-ID validation flaw in OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) by calling flow.cuda.synchronize() with an invalid or out-of-range GPU device index.
A dimension validation flaw in the flow.empty() component of OneFlow 0.9.0 allows attackers to cause a Denial of Service (DoS) via a negative or excessively large dimension value.
A division-by-zero vulnerability in the flow.floor_divide() component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input tensor with zero.
Improper input validation in OneFlow v0.9.0 allows attackers to cause a segmentation fault via adding a Python sequence to the native code during broadcasting/type conversion.
