Views
No views yet
| Field | Value |
|---|---|
| Package | orbax-checkpoint |
| Version | 0.11.40 (latest) |
| Commit | a87ebc8 |
| Platform | huntr.com |
| CWE | CWE-674 Uncontrolled Recursion |
| CVSS | 7.5 High |
_unchunk_array_leaves_in_place(d) in orbax/checkpoint/msgpack_utils.py recursively traverses a dict deserialized from a msgpack checkpoint file with no depth guard. A 1,001-level nested dict (3,009 bytes) triggers RecursionError.1def _unchunk_array_leaves_in_place(d): # no depth guard
2 for k, v in d.items():
3 elif isinstance(v, dict):
4 _unchunk_array_leaves_in_place(v) # ← unbounded recursionvictim: checkpointer.restore(malicious_dir/)
→ MsgpackHandler.deserialize(dir/checkpoint)
→ msgpack_restore(bytes)
→ _unchunk_array_leaves_in_place(state_dict) ← RecursionError at depth 10011pip install orbax-checkpoint msgpack
2python3 poc_orbax.py[*] Python recursion limit: 1000
[*] Payload: 3009 bytes, depth=1001
[+] CONFIRMED: RecursionError in _unchunk_array_leaves_in_place
[+] CONFIRMED via MsgpackHandler: maximum recursion depth exceeded1def _unchunk_array_leaves_in_place(d, _depth=0):
2 if _depth > 500:
3 raise ValueError('Checkpoint nesting depth exceeds limit')
4 ...
5 _unchunk_array_leaves_in_place(v, _depth + 1)| File | Purpose |
|---|---|
poc_orbax.py | Working PoC |
submission.md | Full technical writeup (markdown) |
report.md | Plain-prose paste target for huntr form |
poc-evidence.html | HTML evidence page with terminal output |
README.md | This file |