README.md

---
license: apache-2.0
tags:
  - security
  - proof-of-concept
  - denial-of-service
---

# Malformed safetensors DoS PoC — exllamav2 `STFile` loader

This repository contains a single deliberately malformed `model.safetensors` file
that triggers an **unhandled exception (Denial of Service)** in the
[`turboderp-org/exllamav2`](https://github.com/turboderp-org/exllamav2) safetensors
loader (`exllamav2/stloader.py`, class `STFile`), verified against commit
`7dc12af3a81f34ac3f27cd7602ed539b638933ca` (package `exllamav2` 0.3.2).

The file's 8-byte header length says the JSON header is 5 bytes, but those bytes are
not valid JSON. `STFile.read_dict()` calls `json.loads(...)` on the header with no
error handling, so opening the file raises an uncaught `json.JSONDecodeError`. The
header is parsed the instant a model shard is opened during loading, so any service
that loads this file as a model crashes before any tensor is read.

## Reproduce

```bash
pip install exllamav2
python -c "from exllamav2.stloader import STFile; STFile.open('model.safetensors')"
```

Expected result: the process aborts with an uncaught `json.decoder.JSONDecodeError`
propagating out of `stloader.py`. (The header-parsing path runs before any
CUDA/C-extension code, so this reproduces on a CPU-only install.)

Harmless file: it triggers an unhandled exception, not code execution.