---
tags:
  - security
  - proof-of-concept
  - protobuf
license: mit
---

# Protocol Buffers DotnetSettings forced_namespace_aliases materialization DoS PoC

This repository contains a benign security research PoC for a `.pb` artifact
that drives repeated-string materialization during
`client_pb2.DotnetSettings.ParseFromString(...)`.

Files:

- `control_one_forced_namespace_alias.pb`
- `malicious_forced_namespace_aliases_5000000.pb`
- `reproduce.py`

Exact public file URLs:

- `https://huggingface.co/hacnho/protobuf-dotnetsettings-forced-namespace-aliases-dos-poc/resolve/main/control_one_forced_namespace_alias.pb`
- `https://huggingface.co/hacnho/protobuf-dotnetsettings-forced-namespace-aliases-dos-poc/resolve/main/malicious_forced_namespace_aliases_5000000.pb`
- `https://huggingface.co/hacnho/protobuf-dotnetsettings-forced-namespace-aliases-dos-poc/resolve/main/reproduce.py`

Expected signal:

- control:
  - `forced_namespace_aliases_len = 1`
  - `first_forced_namespace_alias_len = 9999995`
- malicious:
  - `forced_namespace_aliases_len = 5000000`
- latest local replay:
  - `vmhwm_delta_kb = 199804`
  - `elapsed_ratio = 11.38`
- latest public replay:
  - `vmhwm_delta_kb = 199880`
  - `elapsed_ratio = 11.45`