Proof-of-Concept-POC---CVE-2026-49975-HTTP-2-Bomb-

CVE-2026-49975 - HTTP/2 Bomb Proof of Concept Descripción CVE-2026-49975, también conocida como HTTP/2 Bomb , es una vulnerabilidad de denegación de servicio DoS remoto que afecta a la mayoría de los servidores web principales en su configuración HTTP/2 predeterminada. La vulnerabilidad fue...

CVE-2026-49975-POC

CVE-2026-49975 — HTTP/2 Bomb PoC Proof-of-concept exploit for CVE-2026-49975, a remote denial-of-service vulnerability in HTTP/2 server implementations. Discovered by Quang Luong Calif Security Research, disclosed June 2, 2026. For authorized security testing only. Do not use against infrastructu...

CVE-2026-49975-HTTP-2-Bomb

A triage not exploitation tool to identify attack surfaces exposed to CVE-2026-49975 — "HTTP/2 Bomb". ⚠️ This script does not send attack payloads. It only makes normal HTTP requests and analyzes response headers to flag hosts that warrant manual version/patch verification. About CVE-2026-49975...

CVE-2026-49975

CVE-2026-49975 Bomba HTTP/2 ★ CVE-2026-49975 PoC de la Bomba HTTP/2 ★ Resumen CVE-2026-49975 es una vulnerabilidad de Denegación de Servicio DoS en Apache HTTP Server. La vulnerabilidad ocurre en la ruta de manejo de solicitudes HTTP/2, donde múltiples campos de cabecera cookie pueden fusionarse...

http2-bomb-detector

http2-bomb-detector HTTP/2 Bomb CVE-2026-49975 Non-destructive vulnerability detection tool — for Nginx / Apache httpd Vulnerability Background CVE-2026-49975 is a widespread remote denial-of-service vulnerability in the HTTP/2 protocol layer, discovered by security researcher Quang Luong. This...

CVE-2026-49975

CVE-2026-49975 HTTP/2 Bomb PoC HTTP/2 Remote Denial of Service Vulnerability Replication Tool Vulnerability Overview CVE-2026-49975 is an HTTP/2 denial of service vulnerability affecting major web servers. The vulnerability was discovered by security company Calif using OpenAI Codex in early June...

CVE-2026-49975

CVE-2026-49975 HTTP/2 Bomb Exploit Tool Author : polar bear Version : 2.1 Applicable Vulnerability : CVE-2026-49975 HTTP/2 Protocol Memory Bomb 📖 Vulnerability Principle CVE-2026-49975 is a memory exhaustion vulnerability in the HTTP/2 protocol implementation. The attack chain consists of two key...

http2-bomb

HTTP/2 Bomb - CVE-2026-49975 A denial-of-service DoS proof of concept targeting HTTP/2 servers. By combining HPACK amplification with stream retention, a single machine with a modest network connection can render a vulnerable server unavailable within seconds. Vulnerability CVE: CVE-2026-49975...

http2-bomb-analysis-paper

Bomba HTTP/2: Ataque de cadena de amplificación de referencia indexada HPACK Inmersión técnica independiente de un estudiante de secundaria Junio de 2026 TL;DR Este repositorio contiene mi análisis completo de la vulnerabilidad HTTP/2 Bomb CVE-2026-49975 / CVE-2026-47774, que encadena dos...

cve-2026-49975-http2bomb_reproduction

CVE-2026-49975 HTTP/2 Bomb Complete Reproduction Guide Based on QiAnXin CERT Advisory + Calif Original Research ================================================================ I. Vulnerability Overview CVE-2026-49975 is a critical denial-of-service DoS vulnerability in HTTP/2 server and proxy...

CVE-2025-53020-PoC

CVE-2025-53020 - PoC de Agotamiento de Memoria HTTP/2 Apache httpd Una prueba de concepto que demuestra CVE-2025-53020, una vulnerabilidad de agotamiento de memoria en la implementación HTTP/2 de Apache httpd que encontré a mediados de 2025. 📖 Análisis profundo :...

Updated python-hpack packages fix a security vulnerability

An issue was found in the python-hyper/hpack library, most commonly used as a downstream dependency of the python-hyper/h2 library an HTTP/2 client and server implementation. Unbounded variable integer decoding can cause run-away computation on malformed input leading to On^2 runtime, effectively...

MGASA-2026-0349 Updated python-hpack packages fix a security vulnerability

An issue was found in the python-hyper/hpack library, most commonly used as a downstream dependency of the python-hyper/h2 library an HTTP/2 client and server implementation. Unbounded variable integer decoding can cause run-away computation on malformed input leading to On^2 runtime, effectively...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification through the Hpack.decodeHeaders path in ember-core/shared/src/main/scala/org/http4s/ember/core/h2/Hpack.scala. An attacker can exhaust heap memory and crash an HTTP/2 server...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification through the Hpack.decodeHeaders path in ember-core/shared/src/main/scala/org/http4s/ember/core/h2/Hpack.scala. An attacker can exhaust heap memory and crash an HTTP/2 server...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification through the Hpack.decodeHeaders path in ember-core/shared/src/main/scala/org/http4s/ember/core/h2/Hpack.scala. An attacker can exhaust heap memory and crash an HTTP/2 server...

CVE-2026-54556

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, an unauthenticated HTTP/2 peer can cause an out-of-memory denial of service in the Ember backend with HTTP/2 enabled. The Hpack wrapper in ember-core/shared/src/main/scala/org/http4s/ember/core/h2/Hpack.scala...

http4s has HTTP/2 Denial of Service with Ember Backend

Summary http4s 0.23.x and 1.0 servers running ember with http2 enabled are vulnerable to a denial of service attack using a HPACK bomb vulnerability recently disclosed as affecting other http2 servers. Impact Denial of Service: - Affects any http4s server running the ember backend with HTTP/2...

CVE-2026-54556 Http4s: HTTP/2 Denial of Service with Ember Backend

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, an unauthenticated HTTP/2 peer can cause an out-of-memory denial of service in the Ember backend with HTTP/2 enabled. The Hpack wrapper in ember-core/shared/src/main/scala/org/http4s/ember/core/h2/Hpack.scala...

CVE-2026-54556 Http4s: HTTP/2 Denial of Service with Ember Backend

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, an unauthenticated HTTP/2 peer can cause an out-of-memory denial of service in the Ember backend with HTTP/2 enabled. The Hpack wrapper in ember-core/shared/src/main/scala/org/http4s/ember/core/h2/Hpack.scala...