---

tags:

• security
• proof-of-concept
• gguf
• denial-of-service

---

GGUF tensor-cardinality memory-amplification PoC

This repository hosts a benign security research PoC for a GGUF parser memory-amplification denial of service.

Files

• poc-gguf-many-tensors-200k.gguf

Reproduction

Use gguf 0.19.0:

python3 -m venv .venv-gguf-019
. .venv-gguf-019/bin/activate
pip install gguf==0.19.0
/usr/bin/time -v python - <<'PY'
import gguf
r = gguf.GGUFReader("poc-gguf-many-tensors-200k.gguf")
print("tensors", len(r.tensors), "fields", len(r.fields), "data_offset", r.data_offset)
PY

Observed on the research machine:

• the file is only about 14 MB
• GGUFReader materializes 200,000 tensor entries
• peak RSS grows to roughly 1.0 GB

Under a 900 MB virtual-memory cap, the same open path fails with MemoryError.

Safety note

This artifact is a non-executable malformed model-file PoC for parser-stress testing only.