http2-bomb-analysis-paper

HTTP/2 Bomb: HPACK Indexed-Reference Amplification Chain Attack Un approfondimento tecnico indipendente di uno studente delle superiori Giugno 2026 TL;DR Questo repository contiene la mia analisi completa della vulnerabilità HTTP/2 Bomb CVE-2026-49975 / CVE-2026-47774, che combina due primitive...

http2-bomb-detector

http2-bomb-detector Strumento di rilevamento non distruttivo della vulnerabilità HTTP/2 Bomb CVE-2026-49975 — per Nginx / Apache httpd Contesto della vulnerabilità CVE-2026-49975 è una vulnerabilità diffusa di denial of service remoto a livello di protocollo HTTP/2, scoperta dal ricercatore di...

http2-bomb

HTTP/2 Bomb - CVE-2026-49975 Ein Denial-of-Service DoS-Proof-of-Concept, das auf HTTP/2-Server abzielt. Durch die Kombination von HPACK-Verstärkung mit Stream-Retention kann ein einzelner Rechner mit einer bescheidenen Netzwerkverbindung einen anfälligen Server innerhalb von Sekunden unerreichbar...

CVE-2026-49975

CVE-2026-49975 HTTP/2 Bomb PoC Strumento di riproduzione della vulnerabilità di denial of service remota HTTP/2 Panoramica della vulnerabilità CVE-2026-49975 è una vulnerabilità di denial of service HTTP/2 che colpisce i principali server web. È stata scoperta all'inizio di giugno 2026 dalla...

CVE-2026-49975

Strumento di riproduzione CVE-2026-49975 HTTP/2 Bomb Autore : polar bear Versione : 2.1 Vulnerabilità applicabile : CVE-2026-49975 bomba di memoria del protocollo HTTP/2 📖 Principio della vulnerabilità CVE-2026-49975 è una vulnerabilità di esaurimento della memoria nell'implementazione del...

CVE-2026-49975-HTTP-2-Bomb

Ein Triage kein Exploitation Tool zur Identifizierung von Angriffsflächen, die CVE-2026-49975 — „HTTP/2 Bomb" ausgesetzt sind. ⚠️ Dieses Skript sendet keine Angriffspayloads. Es führt lediglich normale HTTP-Anfragen durch und analysiert Antwort-Header, um Hosts zu markieren, die eine manuelle...

cve-2026-49975-http2bomb_reproduction

CVE-2026-49975 HTTP/2 Bomb Guida completa alla riproduzione Basata sull'advisory CERT di QiAnXin + ricerca originale di Calif ================================================================ I. Panoramica della vulnerabilità CVE-2026-49975 è una vulnerabilità critica di denial-of-service DoS nell...

Proof-of-Concept-POC---CVE-2026-49975-HTTP-2-Bomb-

CVE-2026-49975 - HTTP/2 Bomb Proof of Concept Beschreibung CVE-2026-49975, auch bekannt als HTTP/2 Bomb , ist eine Remote-Denial-of-Service-Schwachstelle DoS, die die meisten gängigen Webserver in ihrer Standard-HTTP/2-Konfiguration betrifft. Die Schwachstelle wurde von OpenAI Codex entdeckt, ind...

CVE-2026-49975-POC

CVE-2026-49975 — PoC della Bomba HTTP/2 Exploit proof-of-concept per CVE-2026-49975, una vulnerabilità di denial-of-service remota nelle implementazioni del server HTTP/2. Scoperto da Quang Luong Calif Security Research, divulgato il 2 giugno 2026. Solo per test di sicurezza autorizzati. Non...

CVE-2025-53020-PoC

CVE-2025-53020 - PoC di Esaurimento della Memoria HTTP/2 di Apache httpd Una proof of concept che dimostra CVE-2025-53020, una vulnerabilità di esaurimento della memoria nell'implementazione HTTP/2 di Apache httpd che ho trovato a metà 2025. 📖 Analisi approfondita :...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification through the Hpack.decodeHeaders path in ember-core/shared/src/main/scala/org/http4s/ember/core/h2/Hpack.scala. An attacker can exhaust heap memory and crash an HTTP/2 server...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification through the Hpack.decodeHeaders path in ember-core/shared/src/main/scala/org/http4s/ember/core/h2/Hpack.scala. An attacker can exhaust heap memory and crash an HTTP/2 server...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification through the Hpack.decodeHeaders path in ember-core/shared/src/main/scala/org/http4s/ember/core/h2/Hpack.scala. An attacker can exhaust heap memory and crash an HTTP/2 server...

CVE-2026-54556

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, an unauthenticated HTTP/2 peer can cause an out-of-memory denial of service in the Ember backend with HTTP/2 enabled. The Hpack wrapper in ember-core/shared/src/main/scala/org/http4s/ember/core/h2/Hpack.scala...

http4s has HTTP/2 Denial of Service with Ember Backend

Summary http4s 0.23.x and 1.0 servers running ember with http2 enabled are vulnerable to a denial of service attack using a HPACK bomb vulnerability recently disclosed as affecting other http2 servers. Impact Denial of Service: - Affects any http4s server running the ember backend with HTTP/2...

CVE-2026-54556 Http4s: HTTP/2 Denial of Service with Ember Backend

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, an unauthenticated HTTP/2 peer can cause an out-of-memory denial of service in the Ember backend with HTTP/2 enabled. The Hpack wrapper in ember-core/shared/src/main/scala/org/http4s/ember/core/h2/Hpack.scala...

CVE-2026-54556

http4s (Scala HTTP library) versions prior to 0.23.35 and 1.0.0-M47 are vulnerable to an out-of-memory denial of service when using the Ember backend with HTTP/2 enabled. The root cause is a HPACK bomb : the Hpack wrapper concatenates HEADERS and CONTINUATION frame fragments into a single decoded...

CVE-2026-54556 Http4s: HTTP/2 Denial of Service with Ember Backend

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, an unauthenticated HTTP/2 peer can cause an out-of-memory denial of service in the Ember backend with HTTP/2 enabled. The Hpack wrapper in ember-core/shared/src/main/scala/org/http4s/ember/core/h2/Hpack.scala...

CVE-2026-49975

CVE-2026-49975 HTTP/2 Bomb ★ CVE-2026-49975 HTTP/2 Bomb PoC ★ Panoramica CVE-2026-49975 è una vulnerabilità Denial of Service DoS in Apache HTTP Server. La vulnerabilità si verifica nel percorso di gestione delle richieste HTTP/2, dove più campi header cookie possono essere uniti senza essere...

Astra Linux – Vulnerability in golang-golang-x-net, golang-1.19

A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, enough to trigger a denial of service due to a small number of small requests...