WolfpackArmy/avro-dos-poc

Avro Model File Vulnerability PoC

Vulnerability

DoS via Deep Nested Schema and Field Explosion in Avro model/data files

Files

• poc_deep_schema.avro — 100-level nested record schema causing recursive parsing overhead
• poc_many_fields.avro — 10,000 fields in schema causing memory/CPU exhaustion
• benign.avro — Clean file for comparison

Reproduce

import fastavro
with open('poc_deep_schema.avro', 'rb') as f:
    reader = fastavro.reader(f)  # Schema parsing overhead from 100-level nesting