CVE-2025-71006

A floating point exception FPE in the oneflow.reshape component of OneFlow v0.9.0 allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2025-65886

The deep learning framework OneFlow v0.9.0 is susceptible to a shape mismatch vulnerability during the tensor shape process. This flaw allows an attacker to cause a Denial of Service (DoS) by providing specially crafted tensor shapes, which can lead to application crashes or the system becoming u...

CVE-2025-71005

A floating point exception FPE in the oneflow.view component of OneFlow v0.9.0 allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2025-71007

OneFlow version 0.9.0 is vulnerable to a Denial of Service (DoS) attack due to an input validation vulnerability in the oneflow.index_add component. An attacker can cause the application to crash or become unresponsive by submitting specially crafted input , specifically related to an improper va...

PT-2026-5215

Name of the Vulnerable Software and Affected Versions OneFlow version 0.9.0 Description A crafted input to the oneflow.reshape component can trigger a floating point exception FPE, leading to a Denial of Service DoS. Recommendations At the moment, there is no information about a newer version tha...

CVE-2025-71004

A segmentation violation in the oneflow.logicalor component of OneFlow v0.9.0 allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2025-65891

OneFlow version v0.9.0 is vulnerable to a Denial of Service (DoS) attack due to a GPU device-ID validation flaw . An attacker can trigger a crash or cause the application to become unresponsive by invoking the flow.cuda.get_device_properties() function with an invalid or negative device index . T...

CVE-2025-65887: Divide By Zero

A division-by-zero vulnerability in the flow.floordivide component of OneFlow v0.9.0 allows attackers to cause a Denial of Service DoS via a crafted input tensor with zero...

CVE-2025-65890

OneFlow version v0.9.0 contains a device-ID validation flaw within the flow.cuda.synchronize() function. This vulnerability allows an attacker to cause a Denial of Service (DoS) by supplying an invalid or out-of-range GPU device index, which can cause the application to crash or become unresponsi...

CVE-2025-71001

A segmentation violation in the flow.columnstack component of OneFlow v0.9.0 allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2025-65891

A GPU device-ID validation flaw in OneFlow v0.9.0 allows attackers to trigger a Denial of Dervice DoS by invoking flow.cuda.getdeviceproperties with an invalid or negative device index...

CVE-2025-71004

A segmentation violation in the oneflow.logicalor component of OneFlow v0.9.0 allows attackers to cause a Denial of Service DoS via a crafted input...

Oneflow security vulnerabilities

OneFlow is an open-source deep learning framework developed by OneFlow. Version 0.9.0 of OneFlow contains a security vulnerability. This vulnerability stems from a problem with the flow.floordivide component, which allows zero-division attacks, potentially leading to denial-of-service attacks usi...

CVE-2025-71002

A floating-point exception FPE in the flow.columnstack component of OneFlow v0.9.0 allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2025-63397

Improper input validation in OneFlow v0.9.0 allows attackers to cause a segmentation fault via adding a Python sequence to the native code during broadcasting/type conversion...

EUVD-2025-50829

Improper input validation in OneFlow v0.9.0 allows attackers to cause a segmentation fault via adding a Python sequence to the native code during broadcasting/type conversion...

CVE-2025-63397

Improper input validation in OneFlow v0.9.0 allows attackers to cause a segmentation fault via adding a Python sequence to the native code during broadcasting/type conversion...

flowflops (>=0.0.1.post2211140919, <=0.0.1.post2211151211) potentially affected by CVE-2025-63397 via oneflow (0.9.0)

oneflow PYPI version 0.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on oneflow and may be impacted: - flowflops =0.0.1.post2211140919, =0.0.1.post2211151211 Source cves: CVE-2025-63397 Source advisory: SNYK:PYTHON-ONEFLOW-13876667...

Improper Input Validation

Overview Affected versions of this package are vulnerable to Improper Input Validation via the flow.eyen function. An attacker can trigger a segmentation fault by adding a Python sequence to the native code. PoC python import oneflow as flow diag = 1.0, 2.0, 3.0 tensor = flow.eye3 + diag...

CVE-2025-63397

The OneFlow deep learning framework (version v0.9.0 ) contains an improper input validation vulnerability. This flaw allows an attacker to trigger a segmentation fault by adding a Python sequence to the native code during broadcasting or type conversion operations. Specifically, the issue can be ...