# MessagePack Model File Vulnerability PoC ## Vulnerability DoS via Deep Nesting Stack Overflow, OOM Bomb, and CPU Exhaustion in MessagePack model files ## Files - `poc_deep_nest.msgpack` — 5,000 levels of nested maps, causes stack overflow on unpack - `poc_oom_bomb.msgpack` — 21 bytes, bin32 header claiming ~2GB allocation - `poc_huge_map.msgpack` — 100K key-value pairs, causes CPU/memory exhaustion - `benign.msgpack` — Clean file for comparison ## Reproduce ```python import msgpack # Stack overflow from deep nesting: with open('poc_deep_nest.msgpack', 'rb') as f: msgpack.unpackb(f.read()) # RecursionError / crash # OOM from fake size header: with open('poc_oom_bomb.msgpack', 'rb') as f: msgpack.unpackb(f.read()) # Attempts ~2GB allocation ```