darrknet-cv2-dos-oom-pos

ericblackgachara/darrknet-cv2-dos-oom-pos

darrknet-cv2-dos-oom-pos is a machine learning model from ericblackgachara. Use it for the machine learning task on the model card, and read the license before you ship it in a product.

Status: PoC CONFIRMED ✅ — Ready for huntr submission

Downloads · 30 days

Access

Public

Updated May 9, 2026

Repo size

133 KB

Likes

Public

Hugging Face

Repo makeup

Click a slice to open those files.

.pdf133 KB · 95%

At a glance

Access: Public
Created: May 9, 2026
Updated: May 9, 2026
SHA: ef27587f

Model card

From the Hugging Face model README

Darknet (via cv2.dnn) — OOM DoS via Unbounded filters in .cfg

Status: PoC CONFIRMED ✅ — Ready for huntr submission

Field	Value
Target	opencv-python DNN module (cv2.dnn.readNetFromDarknet) / darknet
Format	Darknet `.cfg` + `.weights` files
Vuln	CWE-789 — Unbounded output tensor allocation from file-controlled `filters`
CVSS	7.5 High
Trigger	`readNetFromDarknet("evil.cfg", "evil.weights")` → `net.forward()` → `cv2.error`
Effect	`OutOfMemoryError: Failed to allocate 346,112,000,000 bytes`

Quick Repro

python3 poc/make_poc.py    # creates evil.cfg + evil.weights
python3 poc/trigger.py     # cv2.error OutOfMemoryError at net.forward()

Files

poc/make_poc.py — builds evil.cfg + evil.weights
poc/trigger.py — triggers crash
report.md — huntr submission report
evidence/poc-run.html — self-contained HTML evidence

Key Source Location

modules/dnn/src/darknet/darknet_io.cpp — filters read from .cfg with only > 0 check
Output tensor allocated during forward(): h × w × filters × batch × sizeof(float)
416 × 416 × 500000 × 1 × 4 = 346,112,000,000 bytes = 322 GiB → OutOfMemoryError

Attack Summary

Normal YOLO input (416×416×3) with a .cfg setting filters=500000. readNetFromDarknet() loads without error. net.forward() attempts to allocate the output tensor proportional to filters → 322 GiB → crash.

Created: May 9, 2026
Updated: May 9, 2026