st3fan

Exploitability of CVE-2026-111497 in a real aiohttp deployment

Assessment after the experiments in this repository. See docs/03-results.md and docs/04-aiohttp-cve.md for the underlying proofs; docs/02-harness.md for the payload set.

What a random aiohttp app gets today (reliable)

A single pre-auth POST with Content-Encoding: br gives an attacker:

st3fan

root@bee:/home/stefan# smartctl -A /dev/sda
smartctl 7.4 2023-08-01 r5530 [x86_64-linux-6.12.90+deb13.1-amd64] (local build)
Copyright (C) 2002-23, Bruce Allen, Christian Franke, www.smartmontools.org

=== START OF READ SMART DATA SECTION ===
SMART Attributes Data Structure revision number: 1
Vendor Specific SMART Attributes with Thresholds:
ID# ATTRIBUTE_NAME          FLAG     VALUE WORST THRESH TYPE      UPDATED  WHEN_FAILED RAW_VALUE
  5 Reallocated_Sector_Ct   0x0032   100   100   000    Old_age   Always       -       0
  9 Power_On_Hours          0x0032   100   100   000    Old_age   Always       -       89944

st3fan

use std::sync::Mutex;
use actix_web::{delete, get, post, put, web, App, HttpResponse, HttpServer, Result};
use rusqlite::{Connection, OptionalExtension};
use serde::{Deserialize, Serialize};
use utoipa::{OpenApi, ToSchema};
use utoipa_swagger_ui::SwaggerUi;

#[derive(Serialize, ToSchema)]
struct Thing {
    id: i32,

st3fan

FROM alpine:3.20.2
ARG TARGETARCH
COPY foo-${TARGETARCH} /usr/local/bin/foo
ENTRYPOINT ["/usr/local/bin/foo"]

st3fan

window.onload = (event) => {
    const formatter = new Intl.DateTimeFormat('default', {
        weekday: 'short',
        year: 'numeric',
        month: 'long',
        day: 'numeric',
        hour: 'numeric',
        minute: 'numeric',
        second: 'numeric'
    });

st3fan

# /etc/unbound/unbound.conf.d/forwarder.conf

server:
    interface: 0.0.0.0
    port: 53
    do-ip4: yes
    do-udp: yes
    do-tcp: yes
    tls-cert-bundle: "/etc/ssl/certs/ca-certificates.crt"

st3fan

-- Add all upstream DoT servers to one pool
newServer{address="tls://8.8.8.8", tlsHostname="dns.google"}
newServer{address="tls://8.8.4.4", tlsHostname="dns.google"}
newServer{address="tls://1.1.1.1", tlsHostname="cloudflare-dns.com"}
newServer{address="tls://1.0.0.1", tlsHostname="cloudflare-dns.com"}

-- Listen on port 53 (main DNS port)
addLocal("0.0.0.0:53")

-- Use round-robin or another strategy across all servers

st3fan

-- Define backend pools
newServer{address="tls://8.8.8.8", pool="google", tlsHostname="dns.google"}
newServer{address="tls://8.8.4.4", pool="google", tlsHostname="dns.google"}

newServer{address="tls://1.1.1.1", pool="cloudflare", tlsHostname="cloudflare-dns.com"}
newServer{address="tls://1.0.0.1", pool="cloudflare", tlsHostname="cloudflare-dns.com"}

-- Define local listeners
addLocal("127.0.0.1:5301", {pool="google"})
addLocal("127.0.0.1:5302", {pool="cloudflare"})

st3fan

# From https://coredns.io/plugins/forward/

. {
    forward . 127.0.0.1:5301 127.0.0.1:5302
}

.:5301 {
    forward . tls://8.8.8.8 tls://8.8.4.4 {
        tls_servername dns.google
    }

st3fan

#!/usr/bin/env python3

# import-pocket-into-instapaper.py pocket/part_*.csv

import csv
import os
import sys
import time

import requests