Downloads · 30 days
0
tfjs-fill-ops-dos-poc
ericblackgachara/tfjs-fill-ops-dos-poc
tfjs-fill-ops-dos-poc is a machine learning model from ericblackgachara. Use it for the machine learning task on the model card, and read the license before you ship it in a product.
tf.loadGraphModel() + model.predict() executes a Fill op whose dims parameter is an attacker-controlled Const tensor. The Fill op allocates output based on the dims value without bounds checking total allocation size.
Access
Public
Updated May 9, 2026
Repo size
146 KB
Likes
0
Public
Repo makeup
Click a slice to open those files.
.pdf146 KB · 88%
At a glance
- Access
- Public
- Created
- May 9, 2026
- Updated
- May 9, 2026
- SHA
- ab0742e3
Model card
From the Hugging Face model README
TensorFlow.js DoS — Fill Op Unbounded Allocation (CWE-789)
Vulnerability
tf.loadGraphModel() + model.predict() executes a Fill op whose dims parameter is an attacker-controlled Const tensor. The Fill op allocates output based on the dims value without bounds checking total allocation size.
8 bytes of weight data → 2 GB allocation → OOM crash
| Detail | Value |
|---|---|
| Package | @tensorflow/tfjs 4.22.0 |
| CWE | CWE-789: Memory Allocation with Excessive Size Value |
| CVSS | 7.5 High (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) |
| Amplification | 268,435,456x |
Files
| File | Purpose |
|---|---|
| demo_dos_tfjs_final.js | Self-contained Node.js PoC — builds model in memory, serves via HTTP, loads, executes, confirms 2 GB allocation. No external files needed. |
| craft_malicious_tfjs.js | Optional — writes model.json + weights.bin to disk for manual inspection |
Reproduction
npm install @tensorflow/tfjs
node demo_dos_tfjs_final.js
That's it — single command. The script:
- Builds the malicious model.json + weights.bin in memory
- Spins up a local HTTP server to serve them
- Loads the model via
tf.loadGraphModel() - Calls
model.predict()which triggers the Fill op - Prints confirmed allocation size and amplification ratio
How It Works
- The PoC constructs a graph model in memory:
Const(dims) → Const(value) → Fill → Identity - Weight data is 8 bytes:
int32(536870912)+float32(0.0) - Weight validation passes — each Const's data matches its declared shape
model.predict()executes the Fill op, which callstf.fill([536870912], 0.0)- Fill allocates a Float32Array of 536M elements = 2 GB — no bounds check
- TypedArrays bypass V8 heap limits → exhausts system memory → OOM kill
- Created
- May 9, 2026
- Updated
- May 9, 2026