http2-bomb-analysis-paper

HTTP/2 Bomb: Ataque em Cadeia de Amplificação de Referência Indexada HPACK Um mergulho técnico independente de um estudante de ensino médio Junho de 2026 TL;DR Este repositório contém minha análise completa da vulnerabilidade HTTP/2 Bomb CVE-2026-49975 / CVE-2026-47774, que encadeia duas primitiv...

http2-bomb

HTTP/2 Bomb - CVE-2026-49975 Ein Denial-of-Service DoS-Proof-of-Concept, das auf HTTP/2-Server abzielt. Durch die Kombination von HPACK-Verstärkung mit Stream-Retention kann ein einzelner Rechner mit einer bescheidenen Netzwerkverbindung einen anfälligen Server innerhalb von Sekunden unerreichbar...

CVE-2026-54340 h2o has HTTP/2 state amplification

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 9265bdd, there is an HTTP/2 state amplification issue that combines HPACK decompression amplification with Slowloris-style stream stalling. Amplified decoded header state can be retained by stalled HTTP/2 streams,...

Exploit for Memory Allocation with Excessive Size Value in Apache Http_Server

HTTP/2 Bomb - CVE-2026-49975 A denial-of-service DoS proof...

CVE-2026-47774 Envoy vulnerable to HTTP/2 memory exhaustion via cookie header size bypass and HPACK amplification

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.35.11, 1.36.7, 1.37.3, and 1.38.1, a vulnerability in Envoy's HTTP/2 downstream request processing allows an unauthenticated remote client to trigger excessive memory consumption, potentiall...