README.md

This PoC model artifact demonstrates a denial-of-service issue in CoreWeave Tensorizer 2.12.1.

The crafted `.tensors` file contains a valid Tensorizer container prefix and metadata index, but the per-tensor header length field is set to an attacker-controlled oversized value. During deserialization, `_TensorHeaderDeserializer.from_io()` reads this 8-byte length and immediately executes `bytearray(header_len)` before enforcing any maximum size, EOF check, or consistency validation against the metadata index.

Affected path:

- `tensorizer/serialization.py`
- `_TensorHeaderDeserializer.from_io()`
- `TensorDeserializer(..., lazy_load=False)` default eager load path

Impact:

A small malicious model artifact can force the loading process to allocate excessive memory and terminate with `MemoryError` or crash under normal service memory limits. In systems that automatically load Tensorizer model artifacts from Hugging Face, object storage, or user-provided repositories, this can cause application-level denial of service.

Local reproduction:

1. Download `tensorizer_2_12_1_header_len_dos.tensors` from this Hugging Face repository.
2. Run Tensorizer 2.12.1 locally.
3. Load the file with:

```python
from tensorizer import TensorDeserializer

TensorDeserializer(
    "tensorizer_2_12_1_header_len_dos.tensors",
    device="cpu",
    lazy_load=False,
    num_readers=1,
)
```

4. Observe that deserialization fails during header parsing due to unbounded allocation from the forged header length.

Security controls:

Testing was performed only in a local environment with memory limits. No CoreWeave production infrastructure or third-party systems were accessed.

Suggested fix:

Validate `header_len` before allocation. Enforce a reasonable maximum header size, reject truncated reads, and verify that header/data offsets and lengths match the metadata index before constructing buffers.

Estimated severity:

High availability impact in automated model-loading services.

CVSS 3.1: 7.5 - AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H