Downloads · 30 days
0
joblib-legacy-zfile-header-memory-bomb-poc
htdy7703/joblib-legacy-zfile-header-memory-bomb-poc
joblib-legacy-zfile-header-memory-bomb-poc is a machine learning model from htdy7703. Use it for the machine learning task on the model card, and read the license before you ship it in a product.
This PoC shows that a tiny legacy Joblib compatibility artifact can make joblib.load() try to allocate an attacker-chosen decompression buffer before the pickle payload is even validated.
Access
Public
Updated Jul 8, 2026
Repo size
—
Likes
0
Public
Repo makeup
Click a slice to open those files.
.py2 KB · 44%
At a glance
- Access
- Public
- Created
- Jul 8, 2026
- Updated
- Jul 8, 2026
- SHA
- e9d8ba14
Model card
From the Hugging Face model README
Joblib Legacy ZF Header Memory Exhaustion PoC
This PoC shows that a tiny legacy Joblib compatibility artifact can make
joblib.load() try to allocate an attacker-chosen decompression buffer before
the pickle payload is even validated.
What this PoC shows:
- the vulnerable path is the shipped legacy
ZFcompatibility loader injoblib.load() - a legitimate 54-byte legacy artifact can be turned into a memory bomb by mutating only its top-level hex length header
- the failure happens before any array wrapper or pickle structure is trusted
What this PoC does not show:
- arbitrary code execution
- filesystem read or write outside the loaded artifact
- impact on the standard non-legacy Joblib persistence path
Runtime tested:
- Joblib commit
b030e4e1ed6a227c0e587c31b266c03b3b692372 - cloudpickle
3.1.2 - Python
3.14
Run reproduce.py to create a valid legacy artifact, mutate only the ZF
header length, and trigger the allocation attempt through joblib.load().
- Created
- Jul 8, 2026
- Updated
- Jul 8, 2026