Downloads · 30 days
0
huntr-poc-bug01-surrealml-header-allocation-dos
Abhnv7/huntr-poc-bug01-surrealml-header-allocation-dos
huntr-poc-bug01-surrealml-header-allocation-dos is a machine learning model from Abhnv7. Use it for the machine learning task on the model card, and read the license before you ship it in a product.
surrealml-core SurMlFile::fromfile allocates an attacker-controlled amount of memory (up to 4 GiB) based on an unvalidated 4-byte header length field, before reading any of those bytes. A 5-byte malicious .surml file…
Access
Public
Updated Jun 8, 2026
Repo size
—
Likes
0
Public
Repo makeup
Click a slice to open those files.
.txt20.1 KB · 74%
At a glance
- Access
- Public
- Created
- Jun 8, 2026
- Updated
- Jun 8, 2026
- SHA
- 7880fb52
Model card
From the Hugging Face model README
BUG01 — SurrealML unbounded header allocation (DoS)
surrealml-core SurMlFile::from_file allocates an attacker-controlled amount
of memory (up to 4 GiB) based on an unvalidated 4-byte header length field,
before reading any of those bytes. A 5-byte malicious .surml file aborts the
process under a constrained memory limit.
- Repo: https://github.com/surrealdb/surrealml
- Tested commit (latest main == pinned): 152ac2d508f1bae9ee62c46b7d211d80e40a6425
- Vulnerable code: modules/core/src/storage/surml_file.rs:108
- Severity: Medium (DoS, CWE-789 Memory Allocation with Excessive Size Value)
Reproduce
python3 generate_poc_bug01.py # writes poc_bug01.surml (5 bytes)
# build a tiny harness that calls SurMlFile::from_file(path)
( ulimit -v 1048576; ./harness poc_bug01.surml ) # -> aborts (SIGABRT)
Result
memory allocation of 4294967295 bytes failed → abort (exit 134) under a 1GB/2GB
ulimit -v. See BUG01-actual-log.txt for full backtrace.
PoC SHA256: eed37189a108c4fcf83a77d93e43d7186d3e37f4ea555eb6c54cc887d2387b93
- Created
- Jun 8, 2026
- Updated
- Jun 8, 2026