You can deploy this model and start earning money today!

jayantkamble10000/
joblib-zf-crash-poc

Name: joblib-zf-crash-poc
Availability: InStock

mit

Views

No views yet

Joblib Legacy ZF-Format Header Crash — PoC

Vulnerability Summary

read_zfile() in joblib/numpy_pickle_compat.py passes an attacker-controlled length field from the file header directly to zlib.decompress() as bufsize with no bounds checking.

A 29-byte malicious .pkl file crashes any process calling joblib.load() via an unhandled MemoryError or OverflowError.

Affected: joblib ≤ 1.5.3 (latest)
CWE: CWE-400, CWE-755
Impact: Denial of Service — immediate process crash
File size needed: 29 bytes

Vulnerable Code

python

# joblib/numpy_pickle_compat.py
def read_zfile(file_handle):
    ...
    length = int(length, 16)                          # ← ATTACKER-CONTROLLED
    data = zlib.decompress(file_handle.read(), 15, length)  # ← CRASH HERE
    assert len(data) == length, (...)                 # ← never reached

Reproduce