apachedos

该工具利用 CVE-2016-8740 来崩溃运行 Apache HTTPD 2.4.17 - 2.4.23 且支持 HTTP2 的服务器。它通过强制服务器分配极其巨大的 RAM 来使其崩溃，导致计算机无法使用。 可以通过这里下载（你需要从命令行运行它） 使用方法： apachedos 目标 目标端口...

emp3r0r

emp3r0r A self-healing, memory-only C2 for Linux and Windows — agents that survive broken links, never touch disk, and script their way through the Win32 API. What is emp3r0r?...

CVE-2024-27983-nodejs-http2

本仓库基于 CVE-2024-27983 构建了一个易受攻击的 HTTP2 Node.js 服务器（server-nossl.js），该 CVE 利用了 HTTP2 服务器中的 continuation flood 漏洞。 说明： server.js 因使用 SSL 证书而被认定为不受该漏洞影响。 server-nossl.js 易受 continuation flood 攻击。 client.js 是一个用于测试 HTTP2 服务器的小型客户端脚本。 exploits/ 包含基于 HackerOne 报告 的漏洞利用代码。 贡献 请参阅 CONTRIBUTING 了解如何为本项目做出贡...

Afuzz

Afuzz - 自动化Web路径模糊测试工具 Afuzz 是一款为漏洞赏金项目设计的自动化Web路径模糊测试工具。 Afuzz 由 @rapiddns 积极开发中。 功能特性 自动检测网站使用的开发语言，并根据语言生成对应的扩展名 使用黑名单过滤无效页面 使用白名单查找页面中漏洞赏金猎人感兴趣的内容 过滤页面中的随机内容 多种方式判断404错误页面 扫描后对结果进行统计分析，得出最终结论 支持HTTP2 安装 root@kitploit: git clone https://github.com/rapiddns/Afuzz.git cd Afuzz python setup.py...

netty-http2-check

netty-http2-check Offline checker for the 7io.netty:netty-codec-http2 CVEs. Tells you which ones you are actually exposed to — and the single version that fixes all of them: 4.1.136.Final / 4.2.16.Final, a number that appears on none of the seven advisories. CVE-2025-55163 · CVE-2026-33871 ·...

netty-codec-http2: netty-codec-http2: Denial of Service due to resource leak

A flaw was found in netty-codec-http2. A remote attacker could send specially crafted frames that cause a resource leak within the DelegatingDecompressorFrameListener class. This resource leak could lead to an Out Of Memory Error OOME, potentially causing a Denial of Service DoS by taking down th...

UBUNTU-CVE-2026-16028

Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion...

http2-rst-stream-attacker

CVE-2023-44487 和 http2-rst-stream-attacker CVE-2023-44487 CVE-2023-44487 是利用 HTTP2 协议本身的漏洞。在 HTTP2 中，数据请求通过发送 HEADERS 帧发起。服务器收到该帧后，会开始处理你的请求，随后发送 DATA 帧直到所有数据传输完毕。HTTP2 还定义了 RSTSTREAM 帧，可用于在任何时刻关闭一个流。为防止攻击，服务器通常限制并发打开的最大流数量（默认为 100）。如果客户端实际等待所有资源消耗完毕，这个限制很少被触发。该攻击之所以奏效，原因很简单：客户端可以在 任何 时刻发送...

EUVD-2026-72733

A client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never unblocked, eventually causing all threads to be blocked and the whole server to become unresponsive. This is caused by a race condition in the server when handling RSTSTREAM frames and GOAWAY frames...

CVE-2026-16028

Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed streams that streamstate never removes from the connection stream table. When a stream reaches the CLOSED state, streamstate returns the concurrency slot and clears most of the stream's keys, but the entry itself sta...

DEBIAN-CVE-2026-16028

Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed streams that streamstate never removes from the connection stream table. When a stream reaches the CLOSED state, streamstate returns the concurrency slot and clears most of the stream's keys, but the entry itself sta...

CVE-2026-16028

Protocol::HTTP2 (Perl), versions before 1.14 , is vulnerable to memory exhaustion via closed streams that are never removed from the connection stream table. When a stream reaches the CLOSED state, stream_state returns its concurrency slot and clears most keys, but the table entry persists for th...

CVE-2026-16028 Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed streams that stream_state never removes from the connection stream table

Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed streams that streamstate never removes from the connection stream table. When a stream reaches the CLOSED state, streamstate returns the concurrency slot and clears most of the stream's keys, but the entry itself sta...

EUVD-2026-72527

Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed streams that streamstate never removes from the connection stream table. When a stream reaches the CLOSED state, streamstate returns the concurrency slot and clears most of the stream's keys, but the entry itself sta...

CVE-2026-16028 Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed streams that stream_state never removes from the connection stream table

Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed streams that streamstate never removes from the connection stream table. When a stream reaches the CLOSED state, streamstate returns the concurrency slot and clears most of the stream's keys, but the entry itself sta...

CVE-2026-16028

Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed streams that streamstate never removes from the connection stream table. When a stream reaches the CLOSED state, streamstate returns the concurrency slot and clears most of the stream's keys, but the entry itself sta...

PT-2026-86914

Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed streams that stream state never removes from the connection stream table. When a stream reaches the CLOSED state, stream state returns the concurrency slot and clears most of the stream's keys, but the entry itself...

Linux Distros Unpatched Vulnerability : CVE-2026-16028

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed streams that streamstate never removes from the connection stream table. When a...

ROOT-APP-MAVEN-CVE-2026-47244 CVE-2026-47244 in io.netty:netty-codec-http2 - Patched by Root

Root has patched CVE-2026-47244 in the io.netty:netty-codec-http2 package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-50560 CVE-2026-50560 in io.netty:netty-codec-http2 - Patched by Root

Root has patched CVE-2026-50560 in the io.netty:netty-codec-http2 package for Root:Maven. Multiple fixed versions available...