CVE-2025-65887
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
A division-by-zero vulnerability was found in the flow.floor_divide() component of OneFlow v0.9.0. An attacker can cause a Denial of Service (DoS) by providing a crafted input tensor containing zero.
Risk Assessment
The risk is that an attacker can remotely crash the system by sending specially crafted data, potentially disrupting applications using OneFlow and causing service outages.
Recommendation
Update OneFlow to the latest patched version, or implement input validation to reject zero values before passing them to the floor_divide function as a temporary workaround.
Other vulnerabilities in OneFlow
See all- CVE-2025-71001Medium
A segmentation violation in the flow.column_stack component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input.
- CVE-2025-71000High
A vulnerability in the flow.cuda.BoolTensor component of OneFlow v0.9.0 allows an attacker to cause a Denial of Service (DoS) via a crafted input.
- CVE-2025-70999High
A vulnerability in OneFlow v0.9.0 within the flow.cuda.get_device_capability() function fails to properly validate GPU device IDs. An attacker can exploit this by sending a crafted device ID, causing a Denial of Service (DoS).
- CVE-2025-65891High
A GPU device-ID validation flaw in OneFlow v0.9.0 allows attackers to trigger a Denial of Service (DoS) by invoking flow.cuda.get_device_properties() with an invalid or negative device index.
- CVE-2025-65890High
A device-ID validation flaw in OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) by calling flow.cuda.synchronize() with an invalid or out-of-range GPU device index.
- CVE-2025-65889High
A type validation flaw in the flow.dstack() component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input.
- CVE-2025-65888High
A dimension validation flaw in the flow.empty() component of OneFlow 0.9.0 allows attackers to cause a Denial of Service (DoS) via a negative or excessively large dimension value.
- CVE-2025-65886High
A shape mismatch vulnerability in OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) by supplying crafted tensor shapes.
- CVE-2025-63397Medium
In OneFlow v0.9.0, improper input validation allows attackers to cause a segmentation fault by adding a Python sequence to native code during broadcasting or type conversion.
Original NVD description (English source)
A division-by-zero vulnerability in the flow.floor_divide() component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input tensor with zero.