Cyber Resilience

CVE-2025-71003

HighPublic PoC

Published: 28 January 2026

Published
28 January 2026
Modified
03 February 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0007 22.6th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-71003 is a high-severity Improper Input Validation (CWE-20) vulnerability in Oneflow Oneflow. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 22.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-71003 is an input validation vulnerability, classified under CWE-20, affecting the flow.arange() component in OneFlow version 0.9.0. Published on 2026-01-28, this flaw enables attackers to trigger a Denial of Service (DoS) condition by providing a crafted input to the vulnerable function. The issue carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high severity primarily due to its impact on availability.

Attackers can exploit this vulnerability remotely over the network with low attack complexity, requiring no authentication privileges or user interaction. Successful exploitation results in a DoS, disrupting service availability for affected OneFlow instances without compromising confidentiality or integrity.

Mitigation details and further technical discussion are available in the referenced advisories, including https://github.com/Daisy2ang and https://github.com/Oneflow-Inc/oneflow/issues/10656.

EU & UK References

Vulnerability details

An input validation vulnerability in the flow.arange() component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input.

CWE(s)
CWE-20

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
attack.mitre.org →
Why these techniques?

Remote unauthenticated input validation flaw in exposed OneFlow component directly enables T1190 for initial access and T1499.004 for application-layer DoS via crafted input.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2025-71007Same product: Oneflow Oneflow
CVE-2025-65889Same product: Oneflow Oneflow
CVE-2025-65890Same product: Oneflow Oneflow
CVE-2025-65891Same product: Oneflow Oneflow
CVE-2025-65888Same product: Oneflow Oneflow
CVE-2025-65886Same product: Oneflow Oneflow
CVE-2025-71000Same product: Oneflow Oneflow
CVE-2025-70999Same product: Oneflow Oneflow
CVE-2026-26310Shared CWE-20
CVE-2025-66786Shared CWE-20

Affected Assets

oneflow
oneflow
0.9.0

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly addresses the input validation vulnerability in flow.arange() by requiring validation of all inputs to prevent crafted inputs from triggering DoS.

SI-2 Flaw Remediation good match
preventrecover

Ensures timely identification, reporting, and remediation of the specific flaw in OneFlow v0.9.0, mitigating the DoS vulnerability through patching.

SC-5 Denial-of-service Protection partial match
preventdetect

Provides protection against denial-of-service events like those caused by the crafted input, limiting the availability impact even if validation fails.

References