WolfpackArmy/protobuf-dos-poc

Protocol Buffers Model File Vulnerability PoC

Vulnerability

DoS via Deep Nesting, OOM Bomb, and Field Explosion in Protocol Buffer model files

Files

• poc_deep_nest.pb — 5,000 levels of nested embedded messages causing stack overflow
• poc_oom_bomb.pb — 22 bytes, length-delimited field claiming ~2GB
• poc_many_fields.pb — 100K repeated fields causing CPU/memory exhaustion
• benign.pb — Clean file for comparison

Reproduce

from google.protobuf import descriptor_pool, message_factory
# Or simply:
# Deep nesting causes recursive parser to overflow stack
# OOM bomb causes parser to attempt ~2GB allocation from 22-byte file