Kanisia/gguf-array-metadata-dos

GGUF metadata array parser DoS

This PoC demonstrates a small GGUF file that causes gguf.GGUFReader to spend unbounded CPU time parsing malformed metadata.

The crafted file declares a metadata field named tokenizer.ggml.tokens as a GGUFValueType.ARRAY with element type UINT8 and array length 50,000,000, but the file intentionally omits the array payload.

GGUFReader._get_field_parts() trusts the declared length and iterates range(alen[0]) before validating that the payload exists. A 69-byte file therefore causes the parser to hang past the verification timeout, while a control file with array length 4 parses immediately.

Files

• gguf_huge_array_metadata_dos.gguf: malicious PoC file
• control_small_array.gguf: control GGUF file with small array length
• build_and_verify.py: rebuilds the files and verifies the parser behavior
• verify_report.json: local verification output

Reproduction

Install dependencies:

pip install gguf modelscan

Run:

python build_and_verify.py

Expected result:

• control_parse.timeout=false
• control_parse.stdout starts with OK
• malicious_parse.timeout=true
• ModelScan reports total_issues=0 and total_scanned=0 for the PoC file

Impact

Any service that accepts untrusted GGUF files and parses metadata with gguf.GGUFReader can be forced into CPU and memory exhaustion using a very small file.