POC-CVE-2026-49975

-red CVE-2026-49975 HTTP/2 Bomb — HPACK Compression Bomb + Flow-Control Hold PoC Security Research PoC by naheeju ⚠️ This is a working, memory-exhaustion DoS tool — not a toy. It opens streams that force the target to allocate memory and holds them open via HTTP/2 flow-control tricks. As long as...

CVE-2026-49975

CVE-2026-49975 HTTP/2 Bomb PoC HTTP/2 Remote Denial of Service Vulnerability Replication Tool Vulnerability Overview CVE-2026-49975 is an HTTP/2 denial of service vulnerability affecting major web servers. The vulnerability was discovered by security company Calif using OpenAI Codex in early June...

CVE-2026-116662

Tanium addressed a compression bomb vulnerability in Enforce...

CVE-2026-116662 Tanium addressed a compression bomb vulnerability in Enforce.

Tanium addressed a compression bomb vulnerability in Enforce...

CVE-2026-116662

Tanium addressed a compression bomb vulnerability in Enforce . The flaw is categorized under CWE-409 , involving improper handling of highly compressed data (data amplification), which can lead to significant availability impact (Base Score: 7.5). Specific details regarding the vulnerable compone...

EUVD-2026-111243

Tanium addressed a compression bomb vulnerability in Enforce...

CVE-2026-116662: Improper Handling of Highly Compressed Data (Data Amplification)

Tanium addressed a compression bomb vulnerability in Enforce...

PT-2026-127179

Tanium addressed a compression bomb vulnerability in Enforce...

The Brain ADM-ZIP for NodeJS: Resource management error vulnerability

The Brain ADM-ZIP for NodeJS version 0.6.0 has a resource management vulnerability. This vulnerability stems from bypassing compression bomb protection. Attackers can exploit the asynchronous getDataAsync method in methods/inflater.js to bypass the maxOutputLength protection and create ZIP entrie...

CVE-2026-102477

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, a gRPC endpoint does have a configurable per message maximum size in bytes, however the maximum size applies to the received bytes. When applied to a compressed message, this only applies to the compressed si...

CVE-2026-102477

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, a gRPC endpoint does have a configurable per message maximum size in bytes, however the maximum size applies to the received bytes. When applied to a compressed message, this only applies to the compressed si...

CVE-2026-102477

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, a gRPC endpoint does have a configurable per message maximum size in bytes, however the maximum size applies to the received bytes. When applied to a compressed message, this only applies to the compressed si...

CVE-2026-102477

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, a gRPC endpoint does have a configurable per message maximum size in bytes, however the maximum size applies to the received bytes. When applied to a compressed message, this only applies to the compressed si...

CVE-2026-102477

The io.vertx:vertx-gprc-server component in Eclipse Vert.x (versions [4.0.0, 4.5.34], [5.0.0, 5.0.12], [5.1.0, 5.1.9], and [5.2.0, 5.2.0]) is vulnerable to a compression bomb attack . While gRPC endpoints have a configurable maximum message size, the restriction only applies to the compressed siz...

EUVD-2026-101937

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, a gRPC endpoint does have a configurable per message maximum size in bytes, however the maximum size applies to the received bytes. When applied to a compressed message, this only applies to the compressed si...

CVE-2026-102477

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, a gRPC endpoint does have a configurable per message maximum size in bytes, however the maximum size applies to the received bytes. When applied to a compressed message, this only applies to the compressed si...

PT-2026-114833

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, a gRPC endpoint does have a configurable per message maximum size in bytes, however the maximum size applies to the received bytes. When applied to a compressed message, this only applies to the compressed si...

CVE-2026-102477: Improper Handling of Highly Compressed Data (Data Amplification)

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, a gRPC endpoint does have a configurable per message maximum size in bytes, however the maximum size applies to the received bytes. When applied to a compressed message, this only applies to the compressed si...

CLSA-2026-1790063765 libsoup: Fix of 3 CVEs

CVE-2026-15709: bound permessage-deflate inflation to the connection's remaining max-incoming-payload-size allowance in soupwebsocketextensiondeflateprocessincomingmessagewithlimit, so a compression bomb can no longer allocate without limit before the post-inflation size check runs -...

CLSA-2026-1790076145 libsoup: Fix of 3 CVEs

CVE-2026-15709: bound permessage-deflate inflation to the connection's remaining max-incoming-payload-size allowance in soupwebsocketextensiondeflateprocessincomingmessagewithlimit, so a compression bomb can no longer allocate without limit before the post-inflation size check runs -...