---
tags:
  - security
  - proof-of-concept
  - protobuf
license: mit
---

# Protocol Buffers MonitoredResourceDescriptor labels materialization DoS PoC

This repository contains a benign security research PoC for a protobuf binary
artifact that drives large repeated-message materialization during
`google.api.monitored_resource_pb2.MonitoredResourceDescriptor.ParseFromString(...)`.

Files:

- `control_one_type.pb`
- `malicious_labels_5000000.pb`
- `reproduce.py`

Observed behavior:

- control artifact:
  - parses successfully with zero `labels`
  - `type_len = 9999995`
- malicious artifact:
  - both files are `10,000,000` bytes
  - parses successfully with `5,000,000` `labels` entries
  - increases peak RSS by about `330324 kB` in local clean-process replay

Tested runtime:

- `protobuf==7.35.1`
- Python: `/usr/bin/python3`

Public files:

- `https://huggingface.co/hacnho/protobuf-monitoredresourcedescriptor-labels-dos-poc/resolve/main/control_one_type.pb`
- `https://huggingface.co/hacnho/protobuf-monitoredresourcedescriptor-labels-dos-poc/resolve/main/malicious_labels_5000000.pb`
- `https://huggingface.co/hacnho/protobuf-monitoredresourcedescriptor-labels-dos-poc/resolve/main/reproduce.py`

Reproduction:

```bash
python3 reproduce.py
```