Proof-of-Concept-POC---CVE-2026-49975-HTTP-2-Bomb-

CVE-2026-49975 - HTTP/2 Bomb 概念验证 描述 CVE-2026-49975，也称为 HTTP/2 Bomb ，是一种远程拒绝服务（DoS）漏洞，影响大多数主流 Web 服务器在其默认 HTTP/2 配置下的运行。 该漏洞由 OpenAI Codex 在结合两种已存在近十年的技术时发现： HPACK Bomb ：网络中的一个字节在服务器端会转化为完整的标头分配 Slowloris-style hold ：零字节流量控制窗口阻止内存释放 受影响的服务端 服务端| 受影响版本| 状态 ---|---|--- nginx| 1.29.8| ✅ 已修复 Apache...

cve-2026-49975-http2bomb_reproduction

CVE-2026-49975 HTTP/2 Bomb Complete Reproduction Guide Based on QiAnXin CERT Advisory + Calif Original Research ================================================================ I. Vulnerability Overview CVE-2026-49975 is a critical denial-of-service DoS vulnerability in HTTP/2 server and proxy...

GHSA-CJCG-CXMH-9WCR Praxis affected by HTTP/2 Bomb

Summary Multiple denial-of-service vulnerabilities have been discovered in HTTP/2 server implementations. All have been rated with a severity impact of Important. The vulnerabilities target HPACK, the header compression scheme in HTTP/2, where a small request can trigger large memory allocations ...

CVE-2026-49975-HTTP-2-Bomb

一个用于识别暴露于 CVE-2026-49975 — "HTTP/2 炸弹" 的攻击面的 分类 （而非利用）工具。 ⚠️ 此脚本不 发送攻击载荷。它仅发送正常HTTP请求并分析响应头，以标记需要手动版本/补丁验证的主机。 关于 CVE-2026-49975 2026年6月3日披露的"HTTP/2炸弹"是一种未经身份验证的远程拒绝服务攻击，它结合了HPACK压缩炸弹和类似Slowloris的保持连接方式，以耗尽服务器内存。它影响 nginx、Apache httpd、Microsoft IIS、Envoy 和 Cloudflare Pingora 的默认HTTP/2配置。...

CentOS Linux 8.5 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-filesystem / etc (CENTOS8.5:CLSA-2026:1782317575)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2026:1782317575 advisory. - Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's modhttp leads to denial of service via malicious HTTP...

CentOS Linux 6 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-filesystem / nginx-mod-http-geoip / etc (CENTOS6:CLSA-2026:1783633126)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1783633126 advisory. - Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's modhttp leads to denial of service via malicious HTTP request...

AlmaLinux 9.6 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-core / nginx-filesystem / etc (ALMALINUX9.6:CLSA-2026:1781511735)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1781511735 advisory. - Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's modhttp leads to denial of service via malicious HTTP...

Rocky Linux 9.6 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-core / nginx-filesystem / etc (ALMALINUX9.6:CLSA-2026:1781511735)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1781511735 advisory. - Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's modhttp leads to denial of service via malicious HTTP...

CentOS Linux 8.4 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-filesystem / etc (CENTOS8.4:CLSA-2026:1782317138)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1782317138 advisory. - Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's modhttp leads to denial of service via malicious HTTP...

CentOS Linux 7 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-filesystem / nginx-mod-devel / etc (CENTOS7:CLSA-2026:1783791996)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1783791996 advisory. - Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's modhttp leads to denial of service via malicious HTTP request...

AlmaLinux 9.6 [TuxCare] Security Update: mod_http2 (ALMALINUX9.6:CLSA-2026:1781259837)

The AlmaLinux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1781259837 advisory. - Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's modhttp leads to denial of service via malicious HTTP...

Rocky Linux 9.6 [TuxCare] Security Update: mod_http2 (ALMALINUX9.6:CLSA-2026:1781259837)

The Rocky Linux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1781259837 advisory. - Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's modhttp leads to denial of service via malicious HTTP...

CentOS Linux 8 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-filesystem / etc (CENTOS-STREAM8:CLSA-2026:1782317620)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1782317620 advisory. - Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's modhttp leads to denial of service via malicious HTTP...

CVE-2026-49975

CVE-2026-49975 HTTP/2 Bomb ★ CVE-2026-49975 HTTP/2 Bomb PoC ★ 概述 CVE-2026-49975 是 Apache HTTP Server 中的一个拒绝服务（DoS）漏洞。 该漏洞出现在 HTTP/2 请求处理路径中，多个 cookie 头字段可以在不经过 LimitRequestFields 正确计数的情况下合并。 通过发送一个小的 HPACK 编码的 HTTP/2 请求，该请求扩展成多个 cookie 头字段，攻击者可以强制服务器在 Cookie 头合并过程中反复分配内存。 攻击者随后可利用 HTTP/2...

http2-bomb-detector

http2-bomb-detector HTTP/2 Bomb CVE-2026-49975 非破坏性漏洞检测工具 — 针对 Nginx / Apache httpd 漏洞背景 CVE-2026-49975 是一个影响广泛的 HTTP/2 协议层远程拒绝服务漏洞，由安全研究员 Quang Luong 发现。该漏洞利用 HPACK 头部压缩 和 流控制机制 的组合性设计缺陷，攻击者无需身份验证即可在 10-20 秒内耗尽服务器 32GB 内存。 CVSS 3.1 : 9.8（高危） CWE : CWE-789 Memory Allocation with Excessive Size...

nginx:1.26 security update

1.26.3-9.4.0.1 - Require oracle-indexhtml 2:1.26.3-14 - Fixes CVE-2026-42533 2:1.26.3-13 - Fixes CVE-2026-56434 and CVE-2026-60005 2:1.26.3-12 - Resolves: RHEL-191774 - nginx: 'HTTP/2 bomb' nginx fix breaks module ABI causing crashes 2:1.26.3-11 - nginx:1.26/nginx: HTTP/2: Remote Denial of Servic...

nginx:1.26 security update

1.26.3-9.0.1.3 - Require oracle-indexhtml 2:1.26.3-13 - Fixes CVE-2026-56434 and CVE-2026-60005 2:1.26.3-12 - Resolves: RHEL-191774 - nginx: 'HTTP/2 bomb' nginx fix breaks module ABI causing crashes 2:1.26.3-11 - nginx:1.26/nginx: HTTP/2: Remote Denial of Service via compression bomb and...

nginx security update

1.26.3-6.0.1.el102.6 - Reference oracle-indexhtml within Requires Orabug: 33802044 2:1.26.3-6.6 - Resolves: RHEL-219313 - nginx: NGINX: Heap buffer over-read allows memory modification or denial of service CVE-2026-56434 - Resolves: RHEL-217956 - nginx: NGINX: Memory disclosure and denial of...

HTTP/2 Bomb CVE-2026-49975

...

CVE-2026-10725: Improper Handling of Highly Compressed Data (Data Amplification)

Protocol::HTTP2 versions before 1.13 for Perl is vulnerable to a HTTP/2 Bomb. Protocol::HTTP2's inbound HPACK path has no header-list size limit, so a small HTTP/2 request can expand into large server memory the "HTTP/2 bomb". The headersdecode method materialises a full key+value copy per indexe...