CVE-2025-71001
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
A segmentation violation in the flow.column_stack component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input.
Risk Assessment
An attacker can remotely crash the system, leading to service disruption and potential financial losses.
Recommendation
It is recommended to immediately update OneFlow to the latest version that includes a fix for this vulnerability, or apply temporary mitigations restricting access to the component.
Other vulnerabilities in OneFlow
See all- CVE-2025-71000High
A vulnerability in the flow.cuda.BoolTensor component of OneFlow v0.9.0 allows an attacker to cause a Denial of Service (DoS) via a crafted input.
- CVE-2025-70999High
A vulnerability in OneFlow v0.9.0 within the flow.cuda.get_device_capability() function fails to properly validate GPU device IDs. An attacker can exploit this by sending a crafted device ID, causing a Denial of Service (DoS).
- CVE-2025-65891High
A GPU device-ID validation flaw in OneFlow v0.9.0 allows attackers to trigger a Denial of Service (DoS) by invoking flow.cuda.get_device_properties() with an invalid or negative device index.
- CVE-2025-65890High
A device-ID validation flaw in OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) by calling flow.cuda.synchronize() with an invalid or out-of-range GPU device index.
- CVE-2025-65889High
A type validation flaw in the flow.dstack() component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input.
- CVE-2025-65888High
A dimension validation flaw in the flow.empty() component of OneFlow 0.9.0 allows attackers to cause a Denial of Service (DoS) via a negative or excessively large dimension value.
- CVE-2025-65887Medium
A division-by-zero vulnerability was found in the flow.floor_divide() component of OneFlow v0.9.0. An attacker can cause a Denial of Service (DoS) by providing a crafted input tensor containing zero.
- CVE-2025-65886High
A shape mismatch vulnerability in OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) by supplying crafted tensor shapes.
- CVE-2025-63397Medium
In OneFlow v0.9.0, improper input validation allows attackers to cause a segmentation fault by adding a Python sequence to native code during broadcasting or type conversion.
Original NVD description (English source)
A segmentation violation in the flow.column_stack component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input.