oneflow 関連製品全体の CVE とセキュリティ脆弱性情報を集約し、CVSS、EPSS、公開日、脆弱性情報データを掲載しています。
一般的な弱点パターンには vendor risk input validation、バッファオーバーフロー, and vendor risk memory corruption があり、vendor surface production workloads and vendor surface software deployment の利用場面で vendor impact unexpected behavior、アプリケーションクラッシュ, and vendor impact memory corruption などのリスクが生じる可能性があります。
掲載データは公開脆弱性情報とセキュリティ公告に基づき、過去の暴露面と修補優先度の評価に利用できます。
| CVE | 概要 | ソース | CVSS 最大値 | EPSS（%） | 公開 | 更新 |
|---|---|---|---|---|---|---|
| CVE-2025-71011 | An input validation vulnerability in the flow.Tensor.new_empty/flow.Tensor.new_ones/flow.Tensor.new_zeros component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input. | [email protected] | 6.2 | 0.08% | 2026-01-29 | 2026-06-17 |
| CVE-2025-71009 | An input validation vulnerability in the flow.scatter/flow.scatter_add component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted indices. | [email protected] | 6.2 | 0.08% | 2026-01-29 | 2026-06-17 |
| CVE-2025-71008 | A segmentation violation in the oneflow._oneflow_internal.autograd.Function.FunctionCtx.mark_non_differentiable component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input. | [email protected] | 6.2 | 0.05% | 2026-01-29 | 2026-06-17 |
| CVE-2025-71007 | An input validation vulnerability in the oneflow.index_add component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input. | [email protected] | 7.5 | 0.41% | 2026-01-28 | 2026-06-17 |
| CVE-2025-71006 | A floating point exception (FPE) in the oneflow.reshape component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input. | [email protected] | 6.5 | 0.28% | 2026-01-28 | 2026-06-17 |
| CVE-2025-71005 | A floating point exception (FPE) in the oneflow.view component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input. | [email protected] | 6.5 | 0.22% | 2026-01-28 | 2026-06-17 |
| CVE-2025-71004 | A segmentation violation in the oneflow.logical_or component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input. | [email protected] | 6.5 | 0.17% | 2026-01-28 | 2026-06-17 |
| CVE-2025-71003 | An input validation vulnerability in the flow.arange() component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input. | [email protected] | 7.5 | 0.37% | 2026-01-28 | 2026-06-17 |
| CVE-2025-71002 | A floating-point exception (FPE) in the flow.column_stack component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input. | [email protected] | 6.5 | 0.28% | 2026-01-28 | 2026-06-17 |
| CVE-2025-71001 | A segmentation violation in the flow.column_stack component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input. | [email protected] | 6.5 | 0.30% | 2026-01-28 | 2026-07-04 |
| CVE-2025-71000 | An issue in the flow.cuda.BoolTensor component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input. | [email protected] | 7.5 | 0.31% | 2026-01-28 | 2026-07-04 |
| CVE-2025-70999 | A GPU device-ID validation flaw in the flow.cuda.get_device_capability() component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted device ID. | [email protected] | 7.5 | 0.38% | 2026-01-28 | 2026-07-04 |
| CVE-2025-65891 | A GPU device-ID validation flaw in OneFlow v0.9.0 allows attackers to trigger a Denial of Dervice (DoS) by invoking flow.cuda.get_device_properties() with an invalid or negative device index. | [email protected] | 7.5 | 0.54% | 2026-01-28 | 2026-07-04 |
| CVE-2025-65890 | A device-ID validation flaw in OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) by calling flow.cuda.synchronize() with an invalid or out-of-range GPU device index. | [email protected] | 7.5 | 0.45% | 2026-01-28 | 2026-07-04 |
| CVE-2025-65889 | A type validation flaw in the flow.dstack() component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input. | [email protected] | 7.5 | 0.39% | 2026-01-28 | 2026-07-04 |
| CVE-2025-65888 | A dimension validation flaw in the flow.empty() component of OneFlow 0.9.0 allows attackers to cause a Denial of Service (DoS) via a negative or excessively large dimension value. | [email protected] | 7.5 | 0.39% | 2026-01-28 | 2026-07-04 |
| CVE-2025-65887 | A division-by-zero vulnerability in the flow.floor_divide() component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input tensor with zero. | [email protected] | 6.5 | 0.32% | 2026-01-28 | 2026-07-04 |
| CVE-2025-65886 | A shape mismatch vulnerability in OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via supplying crafted tensor shapes. | [email protected] | 7.5 | 0.39% | 2026-01-28 | 2026-07-04 |
| CVE-2025-63397 | Improper input validation in OneFlow v0.9.0 allows attackers to cause a segmentation fault via adding a Python sequence to the native code during broadcasting/type conversion. | [email protected] | 6.5 | 0.30% | 2025-11-10 | 2026-07-04 |
| CVE-2024-36740 | An issue in OneFlow-Inc. Oneflow v0.9.1 allows attackers to cause a Denial of Service (DoS) when index as a negative number exceeds the range of size. | [email protected] | 7.5 | 0.52% | 2024-06-06 | 2026-06-17 |