CVE-2025-65888
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
A dimension validation flaw in the flow.empty() component of OneFlow 0.9.0 allows attackers to cause a Denial of Service (DoS) via a negative or excessively large dimension value.
Risk Assessment
An attacker can remotely crash the system or application using OneFlow, leading to service disruption and potential financial losses.
Recommendation
Immediately update the OneFlow library to the latest version that includes the dimension validation fix, or apply temporary input restrictions.
Other vulnerabilities in OneFlow
See all- CVE-2025-71001Medium
A segmentation violation in the flow.column_stack component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input.
- CVE-2025-71000High
A vulnerability in the flow.cuda.BoolTensor component of OneFlow v0.9.0 allows an attacker to cause a Denial of Service (DoS) via a crafted input.
- CVE-2025-70999High
A vulnerability in OneFlow v0.9.0 within the flow.cuda.get_device_capability() function fails to properly validate GPU device IDs. An attacker can exploit this by sending a crafted device ID, causing a Denial of Service (DoS).
- CVE-2025-65891High
A GPU device-ID validation flaw in OneFlow v0.9.0 allows attackers to trigger a Denial of Service (DoS) by invoking flow.cuda.get_device_properties() with an invalid or negative device index.
- CVE-2025-65890High
A device-ID validation flaw in OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) by calling flow.cuda.synchronize() with an invalid or out-of-range GPU device index.
- CVE-2025-65889High
A type validation flaw in the flow.dstack() component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input.
- CVE-2025-65887Medium
A division-by-zero vulnerability was found in the flow.floor_divide() component of OneFlow v0.9.0. An attacker can cause a Denial of Service (DoS) by providing a crafted input tensor containing zero.
- CVE-2025-65886High
A shape mismatch vulnerability in OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) by supplying crafted tensor shapes.
- CVE-2025-63397Medium
In OneFlow v0.9.0, improper input validation allows attackers to cause a segmentation fault by adding a Python sequence to native code during broadcasting or type conversion.
Original NVD description (English source)
A dimension validation flaw in the flow.empty() component of OneFlow 0.9.0 allows attackers to cause a Denial of Service (DoS) via a negative or excessively large dimension value.