PoC: Uncontrolled Recursion in Avro Schema Parsing → Process Crash (SIGSEGV)
Affected: avro (Apache Avro Python package) 1.12.1
Vulnerability class: CWE-674 (Uncontrolled Recursion)
What this repo contains
malicious_schema.avsc — a valid-syntax Avro schema file, 8,756 bytes,
consisting of 350 nested "array" type wrappers around a base "long"
type. Every individual level is syntactically valid Avro; only the
nesting depth is abusive.
How to reproduce
pip install avro
python3 reproduce.py
On an affected system, this crashes the Python process with SIGSEGV
(exit code 139 / "Segmentation fault") — not a caught Python
exception — when the schema is parsed on a thread with a reduced
stack size (256KB, the standard default greenlet stack size used by
gevent/eventlet, common in async Kafka/AMQP consumer deployments
written in Python).
On a default (full-size) thread stack, the same file only produces a
catchable RecursionError — the crash specifically requires the
reduced-stack execution context, which is realistic but not
universal. See the full report for details.
Why this matters
Any Python service that (a) accepts externally-supplied Avro schemas
(e.g. a Kafka consumer that reads schema definitions from message
metadata or a schema registry) and (b) runs on a
gevent/eventlet-style worker, can have its entire worker process
crashed by a single ~9KB malicious schema — not just the one message
being processed.
Full write-up, environment details, threshold measurements, and suggested remediation are in the accompanying disclosure report.