Oneflow vulnerabilities
Published CVEs affecting Oneflow products: 19 record(s), with severity, exploitation and fixes.
CVE-2025-71011
Medium · 6.2
CWE-20 Jan 29, 2026
Improper Input Validation in Oneflow
An input validation vulnerability in the flow.Tensor.new_empty/flow.Tensor.new_ones/flow.Tensor.new_zeros component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVE-2025-71009
Medium · 6.2
CWE-20 Jan 29, 2026
Improper Input Validation in Oneflow
An input validation vulnerability in the flow.scatter/flow.scatter_add component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted indices.
CVE-2025-71008
Medium · 6.2
Jan 29, 2026
A segmentation violation in the oneflow._oneflow_internal.autograd.Function.FunctionCtx.m…
A segmentation violation in the oneflow._oneflow_internal.autograd.Function.FunctionCtx.mark_non_differentiable component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVE-2025-71007
High · 7.5
CWE-20 Jan 28, 2026
Improper Input Validation in Oneflow
An input validation vulnerability in the oneflow.index_add component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVE-2025-71006
Medium · 6.5
CWE-369 Jan 28, 2026
A floating point exception (FPE) in the oneflow.reshape component of OneFlow v0.9.0…
A floating point exception (FPE) in the oneflow.reshape component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVE-2025-71005
Medium · 6.5
CWE-369 Jan 28, 2026
A floating point exception (FPE) in the oneflow.view component of OneFlow v0.9.0 allows…
A floating point exception (FPE) in the oneflow.view component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVE-2025-71004
Medium · 6.5
CWE-125 Jan 28, 2026
Out-of-bounds Read in Oneflow
A segmentation violation in the oneflow.logical_or component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVE-2025-71003
High · 7.5
CWE-20 Jan 28, 2026
Improper Input Validation in Oneflow
An input validation vulnerability in the flow.arange() component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVE-2025-71002
Medium · 6.5
CWE-369 Jan 28, 2026
A floating-point exception (FPE) in the flow.column_stack component of OneFlow v0.9.0…
A floating-point exception (FPE) in the flow.column_stack component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVE-2025-71001
Medium · 6.5
CWE-125 Jan 28, 2026
Out-of-bounds Read in Oneflow
A segmentation violation in the flow.column_stack component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVE-2025-71000
High · 7.5
CWE-400 Jan 28, 2026
Uncontrolled Resource Consumption in Oneflow
An issue in the flow.cuda.BoolTensor component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVE-2025-70999
High · 7.5
CWE-400 Jan 28, 2026
Uncontrolled Resource Consumption in Oneflow
A GPU device-ID validation flaw in the flow.cuda.get_device_capability() component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted device ID.
CVE-2025-65891
High · 7.5
CWE-400 Jan 28, 2026
Uncontrolled Resource Consumption in Oneflow
A GPU device-ID validation flaw in OneFlow v0.9.0 allows attackers to trigger a Denial of Dervice (DoS) by invoking flow.cuda.get_device_properties() with an invalid or negative device index.
CVE-2025-65890
High · 7.5
CWE-400 Jan 28, 2026
Uncontrolled Resource Consumption in Oneflow
A device-ID validation flaw in OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) by calling flow.cuda.synchronize() with an invalid or out-of-range GPU device index.
CVE-2025-65889
High · 7.5
CWE-400 Jan 28, 2026
Uncontrolled Resource Consumption in Oneflow
A type validation flaw in the flow.dstack() component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVE-2025-65888
High · 7.5
CWE-400 Jan 28, 2026
Uncontrolled Resource Consumption in Oneflow
A dimension validation flaw in the flow.empty() component of OneFlow 0.9.0 allows attackers to cause a Denial of Service (DoS) via a negative or excessively large dimension value.
CVE-2025-65887
Medium · 6.5
CWE-369 Jan 28, 2026
A division-by-zero vulnerability in the flow.floor_divide() component of OneFlow v0.9.0…
A division-by-zero vulnerability in the flow.floor_divide() component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input tensor with zero.
CVE-2025-65886
High · 7.5
CWE-400 Jan 28, 2026
Uncontrolled Resource Consumption in Oneflow
A shape mismatch vulnerability in OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via supplying crafted tensor shapes.
CVE-2025-63397
Medium · 6.5
CWE-20 Nov 10, 2025
Improper Input Validation in Oneflow
Improper input validation in OneFlow v0.9.0 allows attackers to cause a segmentation fault via adding a Python sequence to the native code during broadcasting/type conversion.