| # PoC: Uncontrolled Recursion in Avro Schema Parsing → Process Crash (SIGSEGV) |
|
|
| **Affected:** `avro` (Apache Avro Python package) 1.12.1 |
| **Vulnerability class:** CWE-674 (Uncontrolled Recursion) |
|
|
| ## What this repo contains |
|
|
| `malicious_schema.avsc` — a valid-syntax Avro schema file, 8,756 bytes, |
| consisting of 350 nested `"array"` type wrappers around a base `"long"` |
| type. Every individual level is syntactically valid Avro; only the |
| nesting depth is abusive. |
|
|
| ## How to reproduce |
|
|
| ```bash |
| pip install avro |
| python3 reproduce.py |
| ``` |
|
|
| On an affected system, this crashes the Python process with SIGSEGV |
| (exit code 139 / "Segmentation fault") — not a caught Python |
| exception — when the schema is parsed on a thread with a reduced |
| stack size (256KB, the standard default greenlet stack size used by |
| `gevent`/`eventlet`, common in async Kafka/AMQP consumer deployments |
| written in Python). |
|
|
| On a default (full-size) thread stack, the same file only produces a |
| catchable `RecursionError` — the crash specifically requires the |
| reduced-stack execution context, which is realistic but not |
| universal. See the full report for details. |
|
|
| ## Why this matters |
|
|
| Any Python service that (a) accepts externally-supplied Avro schemas |
| (e.g. a Kafka consumer that reads schema definitions from message |
| metadata or a schema registry) and (b) runs on a |
| `gevent`/`eventlet`-style worker, can have its entire worker process |
| crashed by a single ~9KB malicious schema — not just the one message |
| being processed. |
|
|
| Full write-up, environment details, threshold measurements, and |
| suggested remediation are in the accompanying disclosure report. |
|
|
