You can deploy this model and start earning money today!

Madhan-Alagarsamy/
safetensors-oversized-metadata-poc

Name: safetensors-oversized-metadata-poc
Availability: InStock

Views

No views yet

Safetensors Oversized Metadata PoC

This repository contains a safe, non-executable proof-of-concept file demonstrating a
Denial-of-Service (DoS) vulnerability in the SafeTensors file format.

The issue occurs because SafeTensors does not enforce any limit on metadata (header) size.
A .safetensors file may contain hundreds of thousands of metadata entries, which the parser loads fully into memory, causing massive RAM usage.

Summary

The .safetensors file included here contains intentionally oversized metadata.
The file is a valid SafeTensors file, but designed to cause extreme memory usage when parsed.
When loaded, systems typically consume 1.5–2.0 GB of RAM, leading to potential slowdowns or crashes.

This PoC supports responsible vulnerability testing and disclosure.

Files Included

oversized_metadata.safetensors
- Valid SafeTensors structure
- Extremely large metadata header
- Zero data payload
- Safe to host, but unsafe to load
generate_poc.py
- Script used to generate the PoC file
- Included for reproduction and verification

Warning

Do NOT load oversized_metadata.safetensors on:

memory-limited systems
production servers
machines where memory exhaustion may cause downtime

This PoC causes RAM spikes by design.

Reproduction (Clear & Verified)

Use this exact code to trigger the issue:

python

from safetensors import safe_open
import psutil, os

def get_ram_mb():
    return psutil.Process(os.getpid()).memory_info().rss / (1024 * 1024)

print(f"[+] Initial RAM: {get_ram_mb():.2f} MB")

# Load the oversized metadata file
with safe_open("oversized_metadata.safetensors", framework="pt") as f:
    keys = f.keys()  # <-- This triggers full metadata parsing

print(f"[+] RAM After Parsing: {get_ram_mb():.2f} MB")
print("[!] Large RAM increase confirms the issue.")

Madhan-Alagarsamy/safetensors-oversized-metadata-poc