You need to agree to share your contact information to access this model

This repository is publicly accessible, but you have to accept the conditions to access its files and content.

fastavro Union/Enum Negative Index — Security Research PoC

⚠️ This is not a functional ML model. This repository contains proof-of-concept artifacts for a security vulnerability disclosure submitted via the huntr bug bounty platform (Model File Vulnerabilities program).

What this is

These .avro files demonstrate a silent type-confusion vulnerability in the fastavro Python library (tested on version 1.12.2 and earlier), caused by unvalidated negative indices during Union/Enum schema resolution.

base_odds.avro: a clean baseline payload with a schema expecting a float field.
poisoned_odds.avro: a crafted payload that exploits the unvalidated negative index to make fastavro silently decode a string where a float was expected, with no exception raised.

Full technical writeup

A full reproduction environment — including root-cause analysis, PoC generation scripts, and an end-to-end lab pipeline (Apache Airflow + Elasticsearch) demonstrating downstream impact — is maintained privately and available on request to the maintainer or triage team.

Responsible disclosure

This repository exists strictly for authorized security research and coordinated disclosure. Do not use these payloads against any production system, pipeline, or environment without explicit authorization.

Status: Reported to huntr (pending validation).

Downloads last month: -; Downloads are not tracked for this model. How to track

Inference Providers NEW

This model isn't deployed by any Inference Provider. 🙋 Ask for provider support