hacnho/protobuf-distribution-bucket-counts-dos-poc

Protocol Buffers Distribution bucket_counts materialization DoS PoC

This repository contains a benign security research PoC for a .pb artifact that drives repeated-scalar materialization during distribution_pb2.Distribution.ParseFromString(...).

Tested version and trigger:

• protobuf==7.35.1
• distribution_pb2.Distribution().ParseFromString(...)

Files:

• control_one_attachment.pb
• malicious_bucket_counts_5000000.pb
• reproduce.py

Exact public file URLs:

• https://huggingface.co/hacnho/protobuf-distribution-bucket-counts-dos-poc/resolve/main/control_one_attachment.pb
• https://huggingface.co/hacnho/protobuf-distribution-bucket-counts-dos-poc/resolve/main/malicious_bucket_counts_5000000.pb
• https://huggingface.co/hacnho/protobuf-distribution-bucket-counts-dos-poc/resolve/main/reproduce.py

Reproduction:

python3 reproduce.py \
  --control control_one_attachment.pb \
  --malicious malicious_bucket_counts_5000000.pb

Expected signal:

• control: bucket_counts_len = 0, attachments_len = 1
• malicious: bucket_counts_len = 5000000
• latest public replay: vmhwm_delta_kb = 100848, elapsed_ratio = 7.86