safetensors-zero-sized-tensor-bomb-poc

SafeTensors Zero-Sized Tensor Bomb PoC

This PoC demonstrates a memory-exhaustion denial of service in the Python eager get_tensors path by generating a header-only .safetensors file with a very large number of valid zero-sized tensors.

What this PoC shows

• safetensors.numpy.load_file(...) eagerly materializes one array object per zero-sized tensor.
• A crafted file can stay header-only while still forcing very large process memory growth.
• The issue was verified against the shipped safetensors Python wheel 0.8.0.

What this PoC does not show

• It does not claim arbitrary code execution.
• It does not claim arbitrary file read or write.
• It does not prove every downstream library is affected in the same way; the verified path here is the Python eager loader.

Files

• reproduce.py: builds a crafted file and optionally loads it with safetensors.numpy.load_file

Setup

python3 -m pip install safetensors numpy

Example

python3 reproduce.py --count 500000 --path zero_500k.safetensors --load

Expected effect:

• a file of about 29 MB
• 500000 empty tensors materialized
• large process RSS growth