Downloads · 30 days
0
safetensors-zero-sized-tensor-header-bomb-poc
htdy7703/safetensors-zero-sized-tensor-header-bomb-poc
safetensors-zero-sized-tensor-header-bomb-poc is a machine learning model from htdy7703. Use it for the machine learning task on the model card, and read the license before you ship it in a product.
This PoC shows that the shipped safetensors 0.8.0 wheel can abort during safeopen(...) itself when the header contains 1,000,000 zero-sized tensor descriptors.
Access
Public
Updated Jul 8, 2026
Repo size
—
Likes
0
Public
Repo makeup
Click a slice to open those files.
Other1.5 KB · 42%
At a glance
- Access
- Public
- Created
- Jul 8, 2026
- Updated
- Jul 8, 2026
- SHA
- 30102a05
Model card
From the Hugging Face model README
safetensors zero-sized tensor header bomb PoC
This PoC shows that the shipped safetensors 0.8.0 wheel can abort during safe_open(...) itself when the header contains 1,000,000 zero-sized tensor descriptors.
-
What this shows:
- public
safe_open(..., framework="np")can fail before any tensor materialization - a
57,888,899byte file with no payload bytes is enough to trigger the issue - the effect is distinct from the previously observed eager
get_tensors()zero-sized-tensor path because this repro only enterssafe_open(...)
- public
-
What this does not show:
- filesystem access
- code execution
- metadata-only header abuse
-
Verified runtime:
safetensors 0.8.0numpy 2.5.1- Linux
Run python3 reproduce.py.
- Created
- Jul 8, 2026
- Updated
- Jul 8, 2026