fastsafetensors header DoS — PoC model file
Security proof-of-concept for a Denial-of-Service in
foundation-model-stack/fastsafetensors
(HEAD 8d35826). Reported via huntr's Model File Vulnerability program.
model.safetensors is a ~80-byte safetensors file whose header carries a tensor
entry with an invalid dtype. Loading it crashes the parser with an uncaught
ValueError, before any tensor data is read. This affects any app using
fastsafetensors, including vLLM / SGLang started with --load-format fastsafetensors.
Reproduce
from fastsafetensors.common import SafeTensorsMetadata
from fastsafetensors.frameworks import get_framework_op
SafeTensorsMetadata.from_file("model.safetensors", get_framework_op("pytorch"))
# -> ValueError: 'NOTADTYPE' is not a valid DType (uncaught -> loader crash)