| ---
|
| license: apache-2.0
|
| tags:
|
| - security
|
| - proof-of-concept
|
| - denial-of-service
|
| ---
|
|
|
| # runai-model-streamer header DoS — PoC model file
|
|
|
| Security proof-of-concept for a Denial-of-Service in
|
| [`run-ai/runai-model-streamer`](https://github.com/run-ai/runai-model-streamer)
|
| (commit `5c83ddb`). Reported via huntr's Model File Vulnerability program.
|
|
|
| `model.safetensors` is a 78-byte safetensors file whose header omits the `dtype`
|
| key. Loading it through the public `SafetensorsStreamer` API crashes the parser
|
| with an uncaught `KeyError`, before any tensor data is read. This affects any app
|
| using runai-model-streamer, including vLLM started with `--load-format runai_streamer`.
|
|
|
| ## Reproduce
|
| `pip install runai-model-streamer torch` — no GPU required:
|
| ```python
|
| from runai_model_streamer.safetensors_streamer.safetensors_streamer import SafetensorsStreamer
|
| with SafetensorsStreamer() as s:
|
| s.stream_file("model.safetensors")
|
| list(s.get_tensors())
|
|
|
| -> KeyError: 'dtype' (uncaught -> loader crash)
|
| Harmless file: it triggers an unhandled exception, not code execution. |
