NumPy — OOM DoS via Oversized Shape in .npy Header

Status: PoC CONFIRMED ✅ — Ready for huntr submission

Field	Value
Target	numpy (huntr.com — numpy/numpy)
Format	NumPy `.npy` / `.npz` array files
Vuln	CWE-789 — Unbounded Memory Allocation → MemoryError DoS
CVSS	7.5 High
Trigger	`numpy.load("bomb.npy")` — no flags required
Effect	`MemoryError: Unable to allocate 8.00 TiB for array with shape (1099511627776,)`

Quick Repro

python3 poc/make_poc.py    # creates bomb.npy (128 bytes)
python3 poc/trigger.py     # MemoryError → crash

Files

poc/make_poc.py — builds bomb.npy (128 bytes)
poc/trigger.py — triggers crash
poc/bomb.npy — malicious array file
report.md — huntr submission report
evidence/poc-run.html — self-contained HTML evidence

Key Source Location

numpy/lib/_format_impl.py — read_array() ~line 1089
count = numpy.multiply.reduce(shape, dtype=numpy.int64) — no upper bound on count
array = numpy.ndarray(count, dtype=dtype) — allocates before reading any data

Attack Summary

128-byte .npy file with header declaring shape (2^40,) float64. numpy.load() computes count=1,099,511,627,776, allocates before reading data → 8 TiB → MemoryError. Same path applies to .npz files (ZIP of .npy arrays).

Downloads last month: -; Downloads are not tracked for this model. How to track

Inference Providers NEW

This model isn't deployed by any Inference Provider. 🙋 Ask for provider support