Vulnerable code sample

import urllib3
import sys

# This code uses a hypothetical vulnerable version of urllib3 (e.g., < 2.6.0)
# as described in the CVE. The vulnerability is not in this client code, but
# in the library's handling of a malicious server response.

# A malicious server would be configured to respond to a request with a
# multi-layered compressed payload and a corresponding Content-Encoding header.
# For example:
# HTTP/1.1 200 OK
# Content-Encoding: gzip, gzip, gzip, gzip, gzip, gzip, gzip, gzip
# Content-Length: 2048
#
# [binary data of a multi-compressed payload]

# URL of the malicious server serving the decompression bomb.
# In a real test, you would set up a local server (e.g., using Flask or http.server)
# to provide this malicious response.
MALICIOUS_URL = "http://localhost:8080/decompression_bomb"

print(f"Attempting to connect to a malicious server at {MALICIOUS_URL}...")
print("This script simulates a client vulnerable to CVE-2025-66418.")
print("If the library were vulnerable, it would now hang, consuming CPU and memory, and likely crash.")

try:
    # 1. Create a PoolManager. By default, `decode_content=True`, which means
    #    urllib3 will automatically handle decompression based on Content-Encoding.
    http = urllib3.PoolManager()

    # 2. Make the request. With `preload_content=True` (the default), urllib3
    #    will read the entire response body and attempt to decompress it in memory.
    #    A vulnerable version would not limit the decompression chain depth.
    response = http.request(
        "GET",
        MALICIOUS_URL,
        # Set a timeout to prevent the script from hanging indefinitely in a demo,
        # although in a real attack, the resource exhaustion would happen very quickly.
        timeout=5.0
    )

    # 3. If the vulnerability were successfully exploited, the program would
    #    crash or be terminated by the OS before ever reaching this point.
    print("\n---")
    print("Request completed successfully (This would not happen in a real attack).")
    print(f"Status: {response.status}")
    print("The library is likely patched or the server did not send a malicious payload.")
    print("---")

except urllib3.exceptions.MaxRetryError:
    print("\n---")
    print("Error: Connection failed. Is the malicious server running?")
    print("Please run a server on localhost:8080 that serves the malicious response.")
    print("---")
    sys.exit(1)
except Exception as e:
    # A timeout exception might occur if the server is running but the decompression
    # takes too long. In a real attack, memory/CPU exhaustion is the primary impact.
    print(f"\n---")
    print(f"An exception occurred, as expected in a demo: {type(e).__name__}")
    print("This could be a timeout, indicating the process was stuck decompressing.")
    print("---")