netcdf-poc-softlink-cycle-2026-05-12

netCDF4 / netcdf-c — Cyclic HDF5 SoftLink → SIGSEGV in rec_read_metadata()

Researcher: lendtrain (Tony Davis) Coordinated disclosure: huntr.com (Model File Format tier) Target format: NetCDF (.nc) — opens through netCDF4.Dataset(path, "r") Affected: netCDF4==1.7.4 / libnetcdf 4.9.3 / libhdf5 1.14.6 (latest pip wheel as of 2026-05-12) CWE: CWE-674 (Uncontrolled Recursion), CWE-770 (Allocation of Resources Without Limits) Impact: Hard process crash (exit=139, SIGSEGV) — no try/except can catch it (native libnetcdf).

What's in this repo

• poc_cycle.nc (3,192 bytes) — minimal HDF5/NetCDF-4 file containing a SoftLink cycle: /g, /g/s, /g/s/up -> /g.
• repro.py — self-contained reproducer (re-builds the file from scratch via h5py, then opens with netCDF4.Dataset).
• README.md — this file.

Reproduction

pip install -U netCDF4 h5py
python repro.py
echo "exit=$?"   # expected: 139 (SIGSEGV)

The crash happens in libhdf5/hdf5open.c::rec_read_metadata() (Unidata/netcdf-c) at the recursive descent into discovered child groups. There is no visited-set or recursion-depth cap, so the SoftLink cycle blows the stack.

Why it's a security issue

In ML / scientific-computing pipelines, .nc files are routinely consumed via xarray + netCDF4-python in PyTorch Dataset / DataLoader ingestion paths (climate, satellite, geospatial, simulation). A 3 KB attacker-controlled .nc file uploaded to a model/dataset registry, notebook attachment, or job queue crashes the consumer process during metadata open — before any application-level validation can run. No auth, no special flags.

Disambiguation

• NOT a duplicate of the 2025 ZDI netCDF-C CVEs (those are time-unit / variable-name parser bugs, not SoftLink group cycles in rec_read_metadata()).
• Related to (but not resolved by) Unidata/netcdf-c#320, which was closed in 2018 after a cycle-rejection fix. The current 4.9.3 wheel still crashes — file as regression / incomplete cycle defense.