An unauthenticated input validation vulnerability in OneFlow v0.9.0 allows remote attackers to cause a Denial of Service, posing a high risk to system availability.

This is an input validation vulnerability within the flow.arange() function. The vulnerability is exploitable by an unauthenticated attacker sending a crafted input to the affected component.

The successful exploitation of this vulnerability results in a Denial of Service, which can cause critical application downtime and interrupt data processing workflows. Given the CVSS score of 7.5, the vulnerability is classified as High severity due to the ease of exploitation over the network and the significant impact on system availability.

Immediate Action: As no specific patch version is currently identified, users should restrict access to the affected OneFlow instance and monitor for updates from the official vendor repository.

Proactive Monitoring: Security teams should monitor system logs for abnormal request patterns or repeated crashes associated with the flow.arange() component.

Compensating Controls: Deploy a Web Application Firewall or similar network filtering solution to inspect and drop malformed inputs targeting the application API to mitigate potential exploitation.

Public Exploit Available: Unknown.

The vulnerability presents a credible risk to availability due to the existence of a proof-of-concept. Organizations should prioritize isolating the affected component and tracking the vendor's repository for a permanent fix to address this input validation deficiency.