---
tags:
  - security
  - proof-of-concept
  - protobuf
license: mit
---

# Protocol Buffers MetricDescriptor monitored_resource_types materialization DoS PoC

This repository contains a benign security research PoC for a protobuf binary
artifact that drives large repeated-string materialization during
`google.api.metric_pb2.MetricDescriptor.ParseFromString(...)`.

Files:

- `control_one_display_name.pb`
- `malicious_monitored_resource_types_6000000.pb`
- `reproduce.py`

Observed behavior:

- control artifact:
  - parses successfully with zero `monitored_resource_types`
- malicious artifact:
  - both files are `12,000,000` bytes
  - parses successfully with `6,000,000` `monitored_resource_types` entries
  - increases peak RSS by about `213988 kB` in local clean-process replay
  - takes about `15.42x` the control parse time

Tested runtime:

- `protobuf==7.35.1`
- Python: `/usr/bin/python3`

Public files:

- `https://huggingface.co/hacnho/protobuf-metricdescriptor-monitored-resource-types-dos-poc/resolve/main/control_one_display_name.pb`
- `https://huggingface.co/hacnho/protobuf-metricdescriptor-monitored-resource-types-dos-poc/resolve/main/malicious_monitored_resource_types_6000000.pb`
- `https://huggingface.co/hacnho/protobuf-metricdescriptor-monitored-resource-types-dos-poc/resolve/main/reproduce.py`

Reproduction:

```bash
python3 reproduce.py
```