WolfpackArmy/npy-oom-dos-poc

NumPy .npy OOM Denial of Service PoC

Vulnerability

Memory Exhaustion via Crafted .npy File Header (CWE-789 / CWE-190)

File: numpy/lib/_format_impl.py, line 860 Impact: A ~128-byte .npy file triggers multi-gigabyte memory allocation, crashing the process

Files

• oom_bomb_8gb.npy — 128 bytes, requests 8 GB allocation
• oom_bomb_16gb.npy — 128 bytes, requests 16 GB allocation
• oom_bomb_dtype.npy — 128 bytes, requests 2 GB via large dtype

How to reproduce

import numpy as np
# WARNING: This will attempt to allocate 8 GB of memory
arr = np.load('oom_bomb_8gb.npy', allow_pickle=False)

Root Cause

numpy.load() reads shape and dtype from the file header and allocates memory before reading any data. No size limit check exists.