CVE-2025-65886
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
A shape mismatch vulnerability in OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) by supplying crafted tensor shapes.
Risk Assessment
The risk involves potential disruption of services relying on OneFlow through remote triggering of a critical error, leading to service unavailability and operational losses.
Recommendation
Immediately update OneFlow to the latest patched version. If an update is not possible, restrict access to user-input interfaces.
Other vulnerabilities in OneFlow
See all- CVE-2025-71001Medium
A segmentation violation in the flow.column_stack component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input.
- CVE-2025-71000High
A vulnerability in the flow.cuda.BoolTensor component of OneFlow v0.9.0 allows an attacker to cause a Denial of Service (DoS) via a crafted input.
- CVE-2025-70999High
A vulnerability in OneFlow v0.9.0 within the flow.cuda.get_device_capability() function fails to properly validate GPU device IDs. An attacker can exploit this by sending a crafted device ID, causing a Denial of Service (DoS).
- CVE-2025-65891High
A GPU device-ID validation flaw in OneFlow v0.9.0 allows attackers to trigger a Denial of Service (DoS) by invoking flow.cuda.get_device_properties() with an invalid or negative device index.
- CVE-2025-65890High
A device-ID validation flaw in OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) by calling flow.cuda.synchronize() with an invalid or out-of-range GPU device index.
- CVE-2025-65889High
A type validation flaw in the flow.dstack() component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input.
- CVE-2025-65888High
A dimension validation flaw in the flow.empty() component of OneFlow 0.9.0 allows attackers to cause a Denial of Service (DoS) via a negative or excessively large dimension value.
- CVE-2025-65887Medium
A division-by-zero vulnerability was found in the flow.floor_divide() component of OneFlow v0.9.0. An attacker can cause a Denial of Service (DoS) by providing a crafted input tensor containing zero.
- CVE-2025-63397Medium
In OneFlow v0.9.0, improper input validation allows attackers to cause a segmentation fault by adding a Python sequence to native code during broadcasting or type conversion.
Original NVD description (English source)
A shape mismatch vulnerability in OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via supplying crafted tensor shapes.