Proof-of-Concept-POC---CVE-2026-49975-HTTP-2-Bomb-

CVE-2026-49975 - HTTP/2 Bomb 概念実証 説明 CVE-2026-49975（別名 HTTP/2 Bomb ）は、ほとんどの主要なWebサーバーのデフォルトのHTTP/2設定に影響を与えるリモートサービス拒否（DoS）脆弱性です。 この脆弱性は、OpenAI Codex によって、10年前から知られている2つの技術を組み合わせて発見されました： HPACK Bomb : ネットワーク上の1バイトがサーバー上で完全なヘッダー割り当てに変換されます Slowloris式ホールド : メモリ解放を防ぐゼロバイトのフロー制御ウィンドウ 影響を受けるサーバー サーバー|...

CVE-2026-49975-POC

CVE-2026-49975 — HTTP/2 炸弹 PoC 针对 CVE-2026-49975 的概念验证利用程序，这是一种影响 HTTP/2 服务器实现的远程拒绝服务漏洞。由 Quang Luong（Calif 安全研究）发现，于 2026 年 6 月 2 日公开披露。 仅供授权安全测试使用。切勿用于你不拥有或未经书面许可测试的基础设施。 工作原理 该攻击链式利用了两种 HTTP/2 协议机制： 1. HPACK 索引引用炸弹 HPACK（RFC...

cve-2026-49975-http2bomb_reproduction

CVE-2026-49975（HTTP/2 Bomb）完全再現ガイド 奇安信（QiAnXin）CERT アドバイザリ + Calif オリジナル研究に基づく ================================================================ I. 脆弱性の概要 CVE-2026-49975 は、HTTP/2 サーバーおよびプロキシ実装における重大なサービス拒否（DoS）脆弱性です。「HTTP/2 Bomb」または「HPACK Bomb」と呼ばれるこの攻撃は、HTTP/2 プロトコルの 2...

RedGuard

RedGuard - 優れたC2フロントフロー制御ツール 英語 | 中文ドキュメント 0x00 はじめに RedGuardとは...

fides

AIエージェントを情報フロー制御で保護する このリポジトリには、学術論文「Securing AI Agents with Information-Flow Control」に付随するJupyterノートブックが含まれています。 ノートブックはチュートリアルとして構成されており、論文で紹介された概念を読者が理解できるように説明しています。 これは、エージェント型タスクにおいてセキュリティポリシーを決定的に強制するメカニズムの実践的な実装を示し、読者が実験できる実行可能なコードに概念を落とし込んだものです。 セットアップ手順 このノートブックは、Azure OpenAI Chat...

Uncontrolled Resource Consumption

Apache Qpid Broker-J is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to improper enforcement of the session flow control incoming window, which allows an authenticated attacker to exceed the permitted window and cause resource exhaustion, potentially resulting in a...

POC-CVE-2026-49975

-red CVE-2026-49975 HTTP/2 Bomb — HPACK圧縮爆弾 + フロー制御ホールド PoC naheeju によるセキュリティ研究PoC ⚠️ これは動作するメモリ枯渇型DoSツールであり、おもちゃではありません。 標的に対してメモリを割り当てさせ、HTTP/2のフロー制御トリックでストリームを開いたまま保持します。プロセスが実行されている限り、保持を続け、サーバーが接続を切断した場合は自動的に再接続します — 自力では停止しません。影響は --threads、--streams、--headers...

Rocky Linux 9.6 [TuxCare] Security Update: nodejs / nodejs-devel / nodejs-docs / nodejs-full-i18n / etc (ALMALINUX9.6:CLSA-2026:1776939108)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1776939108 advisory. - A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOWUPDATE frames on stream 0 connection-level that cause the flow...

openssl: OpenSSL: Denial of Service via unenforced QUIC connection flow control

A flaw was found in OpenSSL. A remote attacker can cause a Denial of Service DoS due to missing connection-level flow control enforcement in the QUIC protocol implementation. By opening multiple streams that respect individual stream limits while preventing data consumption, the attacker can forc...

openssl: OpenSSL: Denial of Service via unenforced QUIC connection flow control

A flaw was found in OpenSSL. A remote attacker can cause a Denial of Service DoS due to missing connection-level flow control enforcement in the QUIC protocol implementation. By opening multiple streams that respect individual stream limits while preventing data consumption, the attacker can forc...

Denial Of Service

Apache Qpid Proton-J is vulnerable to Denial of Service. The vulnerability is due to insufficient validation of the session flow control incoming window, where an authenticated attacker can exceed the incoming window size and potentially cause denial of service...

CVE-2026-75804

A flaw was found in OpenSSL. A remote attacker can cause a Denial of Service DoS due to missing connection-level flow control enforcement in the QUIC protocol implementation. By opening multiple streams that respect individual stream limits while preventing data consumption, the attacker can forc...

DEBIAN-CVE-2026-75804

Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summary: A malicious remote peer may exploit the lack of connection flow control for streams to make the...

AZL-105594 CVE-2026-75804 affecting package openssl 3.3.7-6

Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summary: A malicious remote peer may exploit the lack of connection flow control for streams to make the...

AZL-105855 CVE-2026-75804 affecting package rust 1.75.0-31

Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summary: A malicious remote peer may exploit the lack of connection flow control for streams to make the...

ALPINE-CVE-2026-75804

Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summary: A malicious remote peer may exploit the lack of connection flow control for streams to make the...

AZL-105510 CVE-2026-75804 affecting package kata-containers 4.1.0.kata0-1

Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summary: A malicious remote peer may exploit the lack of connection flow control for streams to make the...

AZL-105458 CVE-2026-75804 affecting package cloud-hypervisor 52.0.152-1

Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summary: A malicious remote peer may exploit the lack of connection flow control for streams to make the...

AZL-105894 CVE-2026-75804 affecting package rust 1.96.1-2

Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summary: A malicious remote peer may exploit the lack of connection flow control for streams to make the...

AZL-105636 CVE-2026-75804 affecting package openvmm 0.1.0-1

Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summary: A malicious remote peer may exploit the lack of connection flow control for streams to make the...