hacnho/avro-schema-fields-amplification-poc

Avro schema-field amplification PoC

This repository contains a benign security research proof of concept for a valid Avro object-container file whose embedded record schema contains 100000 null fields.

Files

• poc-schema-fields-100k.avro - valid .avro file with one record and a 100000-field record schema
• build-meta-schema-fields.json - file size and measurement summary
• reproduce_avro_schema_fields_amp.py - replay helper for Apache Avro and fastavro

What it demonstrates

The same .avro artifact produces very different behavior across readers:

• Apache avro.datafile.DataFileReader spends about 49 s parsing the embedded schema
• fastavro.reader processes the same file in about 79 ms

The artifact size is only about 3.59 MB.

Quick repro

Install:

• avro==1.12.1
• fastavro==1.12.2

Then run:

python reproduce_avro_schema_fields_amp.py poc-schema-fields-100k.avro

Expected output shape:

{
  "file_size": 3589005,
  "apache": {
    "elapsed_ms": 49091.86
  },
  "fastavro": {
    "elapsed_ms": 79.46
  }
}

This PoC is intended for defensive validation and bug bounty triage only.