PT-2026-5302

Name of the Vulnerable Software and Affected Versions OneFlow version 0.9.0 Description An input validation issue exists in the flow.Tensor.new empty/flow.Tensor.new ones/flow.Tensor.new zeros component. This can lead to a Denial of Service DoS condition through a crafted input. Recommendations A...

CVE-2025-71011

CVE-2025-71011 affects OneFlow v0.9.0: input validation flaw in flow.Tensor.new_empty, flow.Tensor.new_ones, and flow.Tensor.new_zeros can trigger a Denial of Service via crafted input. Multiple connected sources corroborate the issue but do not provide a public fix version. Exploitation is indic...

EUVD-2025-206541

An input validation vulnerability in the flow.Tensor.newempty/flow.Tensor.newones/flow.Tensor.newzeros component of OneFlow v0.9.0 allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2025-71011

An input validation vulnerability in the flow.Tensor.newempty/flow.Tensor.newones/flow.Tensor.newzeros component of OneFlow v0.9.0 allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2025-71008

A segmentation violation in the oneflow.oneflowinternal.autograd.Function.FunctionCtx.marknondifferentiable component of OneFlow v0.9.0 allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2025-71008

CVE-2025-71008 describes a segmentation fault in OneFlow v0.9.0 within the internal autograd path (FunctionCtx.mark_non_differentiable). The issue can be triggered by crafted input to cause a Denial of Service. Affected component: oneflow._oneflow_internal.autograd.Function.FunctionCtx.mark_non_d...

CVE-2025-71008

A segmentation violation in the oneflow.oneflowinternal.autograd.Function.FunctionCtx.marknondifferentiable component of OneFlow v0.9.0 allows attackers to cause a Denial of Service DoS via a crafted input...

EUVD-2025-206539

A segmentation violation in the oneflow.oneflowinternal.autograd.Function.FunctionCtx.marknondifferentiable component of OneFlow v0.9.0 allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2025-71011

An input validation vulnerability in the flow.Tensor.newempty/flow.Tensor.newones/flow.Tensor.newzeros component of OneFlow v0.9.0 allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2025-71008

A segmentation violation in the oneflow.oneflowinternal.autograd.Function.FunctionCtx.marknondifferentiable component of OneFlow v0.9.0 allows attackers to cause a Denial of Service DoS via a crafted input...

Division by zero

Overview Affected versions of this package are vulnerable to Division by zero via the oneflow.reshape process. An attacker can cause the application to crash or become unresponsive by submitting specially crafted input that triggers a floating point exception. Remediation There is no fixed versio...

CVE-2025-71007

An input validation vulnerability in the oneflow.indexadd component of OneFlow v0.9.0 allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2025-71005

A floating point exception FPE in the oneflow.view component of OneFlow v0.9.0 allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2025-71006

A floating point exception FPE in the oneflow.reshape component of OneFlow v0.9.0 allows attackers to cause a Denial of Service DoS via a crafted input...

Uncaught Exception

Overview Affected versions of this package are vulnerable to Uncaught Exception via the oneflow.logicalor function. An attacker can cause the application to crash by submitting specially crafted input. Remediation There is no fixed version for oneflow. References - GitHub Issue Credit: Daisy2ang...

Division by zero

Overview Affected versions of this package are vulnerable to Division by zero via the oneflow.view component. An attacker can cause the application to crash by submitting specially crafted input that triggers a floating point exception. Remediation There is no fixed version for oneflow. Reference...

CVE-2025-71002

A floating-point exception FPE in the flow.columnstack component of OneFlow v0.9.0 allows attackers to cause a Denial of Service DoS via a crafted input...

Division by zero

Overview Affected versions of this package are vulnerable to Division by zero via the flow.columnstack component. An attacker can cause the application to terminate unexpectedly by providing specially crafted input that triggers a floating-point exception. Remediation There is no fixed version fo...

Improper Validation of Specified Quantity in Input

Overview Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input via the flow.cuda.BoolTensor component when processing crafted input. An attacker can cause the application to crash or become unresponsive by submitting specially crafted data...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read via the flow.columnstack component. An attacker can cause the application to crash by submitting specially crafted input. Remediation There is no fixed version for oneflow. References - GitHub Issue Credit: Daisy2ang...