http2-bomb-analysis-paper

HTTP/2 Bomb: HPACK Indexed-Reference Amplification Chain Attack A high school student's independent technical deep-dive June 2026 TL;DR This repository contains my complete analysis of the HTTP/2 Bomb vulnerability CVE-2026-49975 / CVE-2026-47774, which chains two decades-old HTTP/2 primitives:...

Proof-of-Concept-POC---CVE-2026-49975-HTTP-2-Bomb-

CVE-2026-49975 - HTTP/2 Bomb Proof of Concept Description CVE-2026-49975, also known as HTTP/2 Bomb , is a remote denial-of-service DoS vulnerability that affects most major web servers in their default HTTP/2 configuration. The vulnerability was discovered by OpenAI Codex by combining two...

fides

Securing AI Agents with Information-Flow Control This repository contains a Jupyter notebook to accompany the academic paper "Securing AI Agents with Information-Flow Control". The notebook is structured as a tutorial to walk readers through the concepts introduced in the paper. This illustrates ...

CVE-2026-49975-POC

CVE-2026-49975 — HTTP/2 Bomb PoC Proof-of-concept exploit for CVE-2026-49975, a remote denial-of-service vulnerability in HTTP/2 server implementations. Discovered by Quang Luong Calif Security Research, disclosed June 2, 2026. For authorized security testing only. Do not use against infrastructu...

RedGuard

RedGuard - Excellent C2 Front Flow Control tool English | 中文文档 0x00 Introduction What is RedGuard RedGuard, a derivative tool based on command and control C2 front flow control technology, has a lighter design, efficient traffic interaction, and reliable compatibility with development in the go...

cve-2026-49975-http2bomb_reproduction

CVE-2026-49975 HTTP/2 Bomb Complete Reproduction Guide Based on QiAnXin CERT Advisory + Calif Original Research ================================================================ I. Vulnerability Overview CVE-2026-49975 is a critical denial-of-service DoS vulnerability in HTTP/2 server and proxy...

POC-CVE-2026-49975

-red CVE-2026-49975 HTTP/2 Bomb — HPACK Compression Bomb + Flow-Control Hold PoC Security Research PoC by naheeju ⚠️ This is a working, memory-exhaustion DoS tool — not a toy. It opens streams that force the target to allocate memory and holds them open via HTTP/2 flow-control tricks. As long as...

http2-bomb-detector

http2-bomb-detector HTTP/2 Bomb CVE-2026-49975 Non-destructive vulnerability detection tool — for Nginx / Apache httpd Vulnerability Background CVE-2026-49975 is a widespread remote denial-of-service vulnerability in the HTTP/2 protocol layer, discovered by security researcher Quang Luong. This...

CVE-2026-49975

CVE-2026-49975 HTTP/2 Bomb PoC HTTP/2 Remote Denial of Service Vulnerability Replication Tool Vulnerability Overview CVE-2026-49975 is an HTTP/2 denial of service vulnerability affecting major web servers. The vulnerability was discovered by security company Calif using OpenAI Codex in early June...

CLEANSTART-2026-IW19449 HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a r...

CVE-2026-78663 affects multiple packages. The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. See references f...

Important: credentials-fetcher

Issue Overview: When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit...

Important: oci-add-hooks

Issue Overview: When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit...

Amazon Linux 2 : soci-snapshotter (ALASDOCKER-2026-148)

The version of soci-snapshotter installed on the remote host is prior to 0.16.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2026-148 advisory. When Trailer headers are sent by a client, the HTTP server internally uses the header values to populate th...

Amazon Linux 2 : amazon-ecr-credential-helper (ALASDOCKER-2026-149)

The version of amazon-ecr-credential-helper installed on the remote host is prior to 0.12.0-5. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2026-149 advisory. When Trailer headers are sent by a client, the HTTP server internally uses the header values to...

Important: amazon-ecr-credential-helper

Issue Overview: When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit...

Amazon Linux 2 : oci-add-hooks (ALASDOCKER-2026-150)

The version of oci-add-hooks installed on the remote host is prior to 0-0.12.20200504git325a340. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2026-150 advisory. When Trailer headers are sent by a client, the HTTP server internally uses the header values ...

Important: soci-snapshotter

Issue Overview: When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit...

Amazon Linux 2 : oci-add-hooks (ALASNITRO-ENCLAVES-2026-127)

The version of oci-add-hooks installed on the remote host is prior to 0-0.12.20200504git325a340. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NITRO-ENCLAVES-2026-127 advisory. When Trailer headers are sent by a client, the HTTP server internally uses the header...

Important: oci-add-hooks

Issue Overview: When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit...

Important: amazon-ecr-credential-helper

Issue Overview: The HTTP/2 server could refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. A malicious client could exploit this to...