Threat Intelligence Database

An input validation vulnerability in the flow.Tensor.new_empty/flow.Tensor.new_ones/flow.Tensor.new_zeros component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input.

MediumVulnerabilityGermanyFranceUnited Kingdom+4#cve#cve-2025-71011

An input validation vulnerability in the flow.scatter/flow.scatter_add component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted indices.

MediumVulnerabilityGermanyFranceUnited Kingdom+3#cve#cve-2025-71009

An input validation vulnerability in the oneflow.index_add component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input.

HighVulnerabilityGermanyFranceNetherlands+3#cve#cve-2025-71007

CVE-2025-71006 is a medium-severity vulnerability in the oneflow.reshape component of OneFlow v0.9.0 that allows attackers to cause a Denial of Service (DoS) via a crafted input triggering a floating point exception. The flaw does not impact confidentiality or integrity but can disrupt availability by crashing the affected system. Exploitation requires no privileges but does require user interaction to supply the malicious input. No known exploits are currently reported in the wild. European organizations using OneFlow for machine learning or data processing could face service interruptions if targeted. Mitigation involves input validation and patching when available. Countries with significant AI and machine learning adoption, such as Germany, France, and the UK, are more likely to be affected.

MediumVulnerabilityGermanyFranceNetherlands+3#cve#cve-2025-71006

CVE-2025-71005 is a medium-severity vulnerability in OneFlow v0.9.0, specifically in the oneflow.view component, where a floating point exception can be triggered by crafted input. This flaw allows unauthenticated attackers to cause a denial of service (DoS) condition, impacting availability without affecting confidentiality or integrity. Exploitation requires user interaction but no privileges, and no known exploits are currently in the wild. The vulnerability stems from improper handling of floating point operations leading to exceptions that crash or hang the application. European organizations using OneFlow for machine learning or data processing may face service disruptions if targeted. Mitigation involves input validation and patching once updates become available, as no official patch links are currently provided. Countries with significant AI and tech sectors, such as Germany, France, and the UK, are most likely to be affected due to higher adoption of such frameworks.

MediumVulnerabilityGermanyFranceNetherlands+3#cve#cve-2025-71005

CVE-2025-71003 is a high-severity input validation vulnerability in the flow.arange() component of OneFlow v0.9.0 that allows remote attackers to cause a Denial of Service (DoS) without authentication or user interaction. The flaw arises from improper input validation, enabling crafted inputs to crash or hang the application, impacting availability. There are no known exploits in the wild yet, and no patches have been published. European organizations using OneFlow for machine learning or data processing workloads could face service disruptions if targeted. Mitigation involves restricting access to OneFlow services, input sanitization, and monitoring for anomalous usage patterns. Countries with significant AI and data science sectors, such as Germany, France, and the UK, are more likely to be affected due to higher adoption rates of such frameworks. The vulnerability has a CVSS score of 7.

HighVulnerabilityGermanyFranceNetherlands+3#cve#cve-2025-71003

CVE-2025-71004 is a medium-severity vulnerability in the oneflow.logical_or component of OneFlow v0.9.0 that allows attackers to cause a Denial of Service (DoS) via crafted input. The flaw is a segmentation violation related to memory safety issues such as null pointer dereference or out-of-bounds access. Exploitation requires network access and user interaction but no privileges. The impact is limited to availability disruption without compromising confidentiality or integrity. No known exploits are currently reported in the wild. European organizations using OneFlow for machine learning or data processing could experience service interruptions if targeted. Mitigation involves input validation, patching when available, and restricting access to vulnerable services.

MediumVulnerabilityGermanyFranceNetherlands+4#cve#cve-2025-71004

A segmentation violation in the flow.column_stack component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input.

An issue in the flow.cuda.BoolTensor component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input.

HighVulnerabilityGermanyFranceNetherlands+2#cve#cve-2025-71000

A GPU device-ID validation flaw in the flow.cuda.get_device_capability() component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted device ID.

HighVulnerabilityGermanyFranceNetherlands+2#cve#cve-2025-70999