cve-2026-49975-http2bomb_reproduction

CVE-2026-49975 HTTP/2 Bomb Complete Reproduction Guide Based on QiAnXin CERT Advisory + Calif Original Research ================================================================ I. Vulnerability Overview CVE-2026-49975 is a critical denial-of-service DoS vulnerability in HTTP/2 server and proxy...

http2-bomb

HTTP/2 Bomb — CVE-2026-49975 PoC усиления потоков HTTP/2 · Docker · веб-консоль Уязвимость HTTP/2 позволяет мультиплексировать несколько потоков поверх одного TCP-соединения. Данный PoC формирует особым образом составленные кадры HEADERS, содержащие большое количество внутренних ссылок, заставляя...

MadeYouReset_Tester

MadeYouReset Checker Легковесный Python-скрипт для обнаружения потенциальной уязвимости веб-сервера к DoS-атаке MadeYouReset на основе HTTP/2, отслеживаемой как CVE-2025-8671 CVSS 7.5 High. Описание MadeYouReset — это DoS-уязвимость HTTP/2, раскрытая в августе 2025 года исследователями из...

CVE-2022-41741-742-Nginx-Vulnerability-Scanner

🛡️ Nginx Vulnerability Scanner m10sec 가 개발했습니다. 이 스크립트는 원격 서버의 Nginx 버전을 자동으로 감지하고 알려진 보안 취약점에 취약한지 평가합니다. 구체적으로는 다음과 같습니다: CVE-2023-44487 – HTTP/2 Rapid Reset Attack CVE-2022-41741 – ngxhttpmp4module의 메모리 손상 CVE-2022-41742 – ngxhttpmp4module의 메모리 정보 노출 🚀 기능 분석할 서버의 URL 또는 IP를 사용자에게 요청합니다. 서버가...

caddy v2.11.7

a project Every site on HTTPS Caddy is an extensible server platform that uses TLS by default. Releases · Documentation · Get Help Powered by Special thanks to: Warp, built for coding with multiple AI agents Available for MacOS, Linux, & Windows Menu Features Install Build from source For...

Security Bulletin: Due to the use of HTTP/2 requests to a Jetty server, IBM Sterling Control Center is vulnerable to Uncontrolled Resource Consumption (CVE-2026-12611)

Summary HTTP/2 requests with Jetty server is used by IBM Sterling Control Center as part of dependency in jetty-http2-common-12.0.25.jar. Vulnerability Details CVEID:CVE-2026-12611 DESCRIPTION: A client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never...

Praxis affected by HTTP/2 Bomb

Summary Multiple denial-of-service vulnerabilities have been discovered in HTTP/2 server implementations. All have been rated with a severity impact of Important. The vulnerabilities target HPACK, the header compression scheme in HTTP/2, where a small request can trigger large memory allocations ...

GHSA-CJCG-CXMH-9WCR Praxis affected by HTTP/2 Bomb

Summary Multiple denial-of-service vulnerabilities have been discovered in HTTP/2 server implementations. All have been rated with a severity impact of Important. The vulnerabilities target HPACK, the header compression scheme in HTTP/2, where a small request can trigger large memory allocations ...

CVE-2026-94084

An invalid memory reference vulnerability exists in Suricata's HTTP/2 application-layer engine during multi-buffer management Http2ThreadMultiBuf. When inspected HTTP/2 response traffic triggers signature rules that evaluate the http.responseheader keyword simultaneously with and without sticky...

axios: Axios: Denial of Service via unhandled error in HTTP/2 session initialization

A flaw was found in Axios. A remote attacker or an unresponsive endpoint can cause a Denial of Service DoS by triggering an error during HTTP/2 session initialization or reuse. Because the underlying session fails to register proper error handlers, network or session failures result in an uncaugh...

axios: axios: Security control bypass via unapplied HTTP/2 proxy and DNS settings

A flaw was found in axios. When processing HTTP/2 requests, the client fails to enforce configured proxy settings and custom Domain Name System DNS resolution policies. A remote attacker who can influence destination URLs could exploit this vulnerability to bypass outbound network restrictions,...

axios: Axios: Denial of Service via unhandled error in HTTP/2 session initialization

A flaw was found in Axios. A remote attacker or an unresponsive endpoint can cause a Denial of Service DoS by triggering an error during HTTP/2 session initialization or reuse. Because the underlying session fails to register proper error handlers, network or session failures result in an uncaugh...

axios: axios: Security control bypass via unapplied HTTP/2 proxy and DNS settings

A flaw was found in axios. When processing HTTP/2 requests, the client fails to enforce configured proxy settings and custom Domain Name System DNS resolution policies. A remote attacker who can influence destination URLs could exploit this vulnerability to bypass outbound network restrictions,...

axios: Axios: Denial of Service via unhandled error in HTTP/2 session initialization

A flaw was found in Axios. A remote attacker or an unresponsive endpoint can cause a Denial of Service DoS by triggering an error during HTTP/2 session initialization or reuse. Because the underlying session fails to register proper error handlers, network or session failures result in an uncaugh...

axios: axios: Security control bypass via unapplied HTTP/2 proxy and DNS settings

A flaw was found in axios. When processing HTTP/2 requests, the client fails to enforce configured proxy settings and custom Domain Name System DNS resolution policies. A remote attacker who can influence destination URLs could exploit this vulnerability to bypass outbound network restrictions,...

CLEANSTART-2026-SM16447 When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface

CVE-2026-56853 affects multiple packages. When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. See references for individual vulnerability details...

net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service

A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...

net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service

A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...

tomcat: Apache Tomcat: Denial of Service via HTTP/2 allocation leak

A flaw was found in Apache Tomcat. This vulnerability, an uncontrolled resource consumption issue, arises from an allocation leak in the HTTP/2 backlog tracking when a stream is reset. A remote attacker could exploit this to cause a Denial of Service DoS, making the server unresponsive or...

net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service

A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...