File size: 1,097 Bytes
1056f9c | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 | ---
license: apache-2.0
tags:
- security
- proof-of-concept
- denial-of-service
---
# runai-model-streamer header DoS — PoC model file
Security proof-of-concept for a Denial-of-Service in
[`run-ai/runai-model-streamer`](https://github.com/run-ai/runai-model-streamer)
(commit `5c83ddb`). Reported via huntr's Model File Vulnerability program.
`model.safetensors` is a 78-byte safetensors file whose header omits the `dtype`
key. Loading it through the public `SafetensorsStreamer` API crashes the parser
with an uncaught `KeyError`, before any tensor data is read. This affects any app
using runai-model-streamer, including vLLM started with `--load-format runai_streamer`.
## Reproduce
`pip install runai-model-streamer torch` — no GPU required:
```python
from runai_model_streamer.safetensors_streamer.safetensors_streamer import SafetensorsStreamer
with SafetensorsStreamer() as s:
s.stream_file("model.safetensors")
list(s.get_tensors())
-> KeyError: 'dtype' (uncaught -> loader crash)
Harmless file: it triggers an unhandled exception, not code execution. |