lexi-core-ai/gguf-recursive-dos-poc

GGUF Recursive Array DoS (CWE-674)

Security Research PoC — Do not use in production

Vulnerability

The GGUF Python library (gguf on PyPI) crashes with RecursionError when parsing a crafted GGUF file containing deeply nested ARRAY metadata.

Reproduction

pip install gguf==0.18.0
python3 poc.py

Files

• nested_array_dos.gguf — Malicious 13KB GGUF file with 1100 nested arrays
• poc.py — PoC that generates and triggers the crash

Impact

Denial of Service on any Python application using GGUFReader with untrusted files.