# CVE-2025-65889: Oneflow-Inc OneFlow denial of service in flow.dstack

Source: https://junglewise.ai/threats/cve-2025-65889-oneflow-inc-oneflow-denial-of-service-in-flow-dstack  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-01-28. Updated: 2026-07-05  
License: CC BY 4.0 with a link back

CVE-2025-65889 · Severity: high · CVSS 7.5 · Published 2026-01-28

OneFlow is an open-source deep learning framework used to build and train artificial intelligence models. A flaw in how the software handles specific data inputs can cause the system to crash unexpectedly. This could allow an attacker to disrupt AI services or research operations by forcing the application to shut down.

Technologies: [Oneflow](https://junglewise.ai/threats/technologies/oneflow). Vendors: [Oneflow](https://junglewise.ai/threats/vendors/oneflow).

## Quick answers

**Is CVE-2025-65889 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-65889 being exploited in the wild.

**How severe is CVE-2025-65889?** High severity, with a CVSS score of 7.5, published 28 January 2026.

**Which products and versions are affected?** Oneflow-Inc OneFlow 0.9.0.

**Is there a fix for CVE-2025-65889?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-65889 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-65889?** Check whether you run Oneflow. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A type validation vulnerability exists in the flow.dstack() component of OneFlow v0.9.0. The issue stems from improper handling of input types, specifically when a mixture of OneFlow tensors and NumPy arrays are passed to the function, leading to a type mismatch. This root cause triggers a segmentation fault and subsequent core dump (CWE-400). An attacker can exploit this by providing specially crafted inputs to the affected function, resulting in a complete denial of service for the application. The vulnerability is reachable over the network if the application exposes an interface that processes user-supplied data through this component.

## Affected products

- Oneflow-Inc OneFlow 0.9.0

## Timeline

- 2025-06-30: disclosed: Issue reported on GitHub repository
- 2026-01-28: advisory: CVE published to NVD

## References

- [https://github.com/Daisy2ang](https://github.com/Daisy2ang)
- [https://github.com/Oneflow-Inc/oneflow](https://github.com/Oneflow-Inc/oneflow)
- [https://github.com/Oneflow-Inc/oneflow/issues/10663](https://github.com/Oneflow-Inc/oneflow/issues/10663)

## Related threats

- [Oneflow-Inc OneFlow segmentation fault in flow.column_stack](https://junglewise.ai/threats/cve-2025-71001-oneflow-inc-oneflow-segmentation-fault-in-flow-column-stack)
- [OneFlow flow.cuda.BoolTensor denial of service via crafted input](https://junglewise.ai/threats/cve-2025-71000-oneflow-flow-cuda-booltensor-denial-of-service-via-crafted-input)
- [OneFlow denial of service in flow.cuda.get_device_capability](https://junglewise.ai/threats/cve-2025-70999-oneflow-denial-of-service-in-flow-cuda-get-device-capability)
- [OneFlow GPU device-ID validation denial of service in get_device_properties](https://junglewise.ai/threats/cve-2025-65891-oneflow-gpu-device-id-validation-denial-of-service-in-get-device)
- [OneFlow denial of service via invalid device ID in CUDA synchronization](https://junglewise.ai/threats/cve-2025-65890-oneflow-denial-of-service-via-invalid-device-id-in-cuda)