CVE-2025-65890

OneFlow version v0.9.0 contains a device-ID validation flaw within the flow.cuda.synchronize() function. This vulnerability allows an attacker to cause a Denial of Service (DoS) by supplying an invalid or out-of-range GPU device index, which can cause the application to crash or become unresponsi...

CVE-2025-65887

OneFlow v0.9.0 is vulnerable to a division-by-zero error in the flow.floor_divide() component. An attacker can exploit this by providing a crafted input tensor containing a zero value , which can lead to a Denial of Service (DoS) by causing the application to crash or become unresponsive. The flo...

CVE-2025-65886

The deep learning framework OneFlow v0.9.0 is susceptible to a shape mismatch vulnerability during the tensor shape process. This flaw allows an attacker to cause a Denial of Service (DoS) by providing specially crafted tensor shapes, which can lead to application crashes or the system becoming u...

CVE-2025-71004

A segmentation violation in the oneflow.logicalor component of OneFlow v0.9.0 allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2025-71002

A floating-point exception FPE in the flow.columnstack component of OneFlow v0.9.0 allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2025-65887

A division-by-zero vulnerability in the flow.floordivide component of OneFlow v0.9.0 allows attackers to cause a Denial of Service DoS via a crafted input tensor with zero...

CVE-2025-65887: Divide By Zero

A division-by-zero vulnerability in the flow.floordivide component of OneFlow v0.9.0 allows attackers to cause a Denial of Service DoS via a crafted input tensor with zero...

CVE-2025-65886

A shape mismatch vulnerability in OneFlow v0.9.0 allows attackers to cause a Denial of Service DoS via supplying crafted tensor shapes...

PT-2026-5215

Name of the Vulnerable Software and Affected Versions OneFlow version 0.9.0 Description A crafted input to the oneflow.reshape component can trigger a floating point exception FPE, leading to a Denial of Service DoS. Recommendations At the moment, there is no information about a newer version tha...

CVE-2025-71002

A floating-point exception FPE in the flow.columnstack component of OneFlow v0.9.0 allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2025-71004

A segmentation violation in the oneflow.logicalor component of OneFlow v0.9.0 allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2025-71001

A segmentation violation in the flow.columnstack component of OneFlow v0.9.0 allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2025-65891

A GPU device-ID validation flaw in OneFlow v0.9.0 allows attackers to trigger a Denial of Dervice DoS by invoking flow.cuda.getdeviceproperties with an invalid or negative device index...

CVE-2025-70999

A GPU device-ID validation flaw in the flow.cuda.getdevicecapability component of OneFlow v0.9.0 allows attackers to cause a Denial of Service DoS via a crafted device ID...

CVE-2025-63397

Improper input validation in OneFlow v0.9.0 allows attackers to cause a segmentation fault via adding a Python sequence to the native code during broadcasting/type conversion...

EUVD-2025-50829

Improper input validation in OneFlow v0.9.0 allows attackers to cause a segmentation fault via adding a Python sequence to the native code during broadcasting/type conversion...

CVE-2025-63397

Improper input validation in OneFlow v0.9.0 allows attackers to cause a segmentation fault via adding a Python sequence to the native code during broadcasting/type conversion...

flowflops (>=0.0.1.post2211140919, <=0.0.1.post2211151211) potentially affected by CVE-2025-63397 via oneflow (0.9.0)

oneflow PYPI version 0.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on oneflow and may be impacted: - flowflops =0.0.1.post2211140919, =0.0.1.post2211151211 Source cves: CVE-2025-63397 Source advisory: SNYK:PYTHON-ONEFLOW-13876667...

Improper Input Validation

Overview Affected versions of this package are vulnerable to Improper Input Validation via the flow.eyen function. An attacker can trigger a segmentation fault by adding a Python sequence to the native code. PoC python import oneflow as flow diag = 1.0, 2.0, 3.0 tensor = flow.eye3 + diag...

OneFlow 安全漏洞

Oneflow is a deep learning framework open-sourced by Oneflow. A security vulnerability exists in OneFlow version v0.9.0 that stems from improper input validation and could lead to a segmentation violation when adding Python sequences during broadcast or type conversion...