http2-bomb

HTTP/2 Bomb — CVE-2026-49975 HTTP/2 Stream Amplification PoC · Docker · Web Console Vulnerability HTTP/2 allows multiplexing multiple streams over a single TCP connection. This PoC crafts specially formed HEADERS frames containing a large number of internal references, forcing the server to...

http-request-smuggler

HTTP Request Smuggler This Burp Suite extension automatically detects and exploits HTTP Request Smuggling vulnerabilities using advanced desynchronization techniques developed by PortSwigger researcher James Kettle. It supports comprehensive scanning for HTTP/1.1 and HTTP/2-downgrade desync...

CVE-2024-52317

🚨🚨CVE-2024-52317🚨🚨 CVE-2024-52317 - Apache Tomcat HTTP/2 Data Leakage Vulnerability Overview CVE-2024-52317 is a vulnerability affecting Apache Tomcat's HTTP/2 implementation. The issue arises due to improper recycling of HTTP/2 request and response resources, potentially leading to data leakage...

cve-2023-44487-POC

cve-2023-44487 - http/2 rapid reset attack by 7pirqte what is this poc for the http/2 rapid reset attack. basically you open a stream with HEADERS frame then immediatly send RSTSTREAM to cancel it. server does all the work setting up and tearing down streams while you just spam requests. the...

CVE-2025-8671

CVE-2025-8671 - PoC DoS lighttpd HTTP/2 Author : @abiyeenzo ⚠️ Warning This project is provided for educational purposes only. Running the PoC against third-party servers may constitute an illegal cyberattack and lead to criminal prosecution. Only use this script on your test environments or local...

CVE-2023-44487-HTTP2-DoS-Rapid-Reset-Exploit

CVE-2023-44487 HTTP/2 DoS Rapid Reset Exploit Professional Edition v1.0.1 | Author: Sudeepa Wanigarathna -orange.svg Table of Contents Overview Vulnerability Details Features Requirements Installation Quick Start Usage Guide Configuration Options Docker Support Examples Understanding Results...

CVE_2023_44487-Rapid_Reset

CVE-2023-44487 HTTP/2 Rapid Reset Testing Tool - Enhanced Edition A comprehensive Python testing tool for CVE-2023-44487 , the HTTP/2 Rapid Reset vulnerability. This repository contains both attack testing and verification-focused tools. ⚠️ IMPORTANT DISCLAIMER This tool is for educational and...

CVE-2026-49975-POC

CVE-2026-49975 — HTTP/2 Bomb PoC Proof-of-concept exploit for CVE-2026-49975, a remote denial-of-service vulnerability in HTTP/2 server implementations. Discovered by Quang Luong Calif Security Research, disclosed June 2, 2026. For authorized security testing only. Do not use against infrastructu...

MadeYouReset_Tester

MadeYouReset Checker A lightweight Python script to detect whether a web server is potentially vulnerable to the MadeYouReset HTTP/2 denial-of-service vulnerability — tracked as CVE-2025-8671 CVSS 7.5 High. Background MadeYouReset is an HTTP/2 DoS vulnerability disclosed in August 2025 by...

nice-cve-poc

Nice CVE PoCs A collection of interesting CVE PoCs CVE-2023-44487 - HTTP/2 Rapid Reset Attack...

CVE-2026-18924

CVE-2026-18924 affects libcurl versions 7.44.0 through 8.21.x , fixed in 8.22.0 . The vulnerability is a use-after-free in the cleanup process when handling HTTP/2 Server Push streams, triggered specifically when the parent handle is configured to share connections with other handles. A HackerOne...

EUVD-2026-72165

A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process...

CVE-2026-18924 HTTP/2 server push UAF

A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process...

Tomcat-CVE-2025-31650

CVE-2025-31650 🚨 Proof of Concept PoC for Apache Tomcat HTTP/2 DoS vulnerability CVE-2025-31650 This script triggers a memory exhaustion condition in Apache Tomcat by sending malformed priority headers over HTTP/2. 🎯 Affected Versions Apache Tomcat 9.0.76 – 9.0.102 Apache Tomcat 10.1.10 – 10.1.39...

CVE-2026-42945-NGINX-Rift-Toolkit

CVE-2026-42945 Nginx Rift भेद्यता टूलकिट CVE-2026-42945 की स्कैनिंग, पैचिंग और परीक्षण के लिए व्यापक टूलकिट - nginx में एक गंभीर RCE भेद्यता विषय-सूची अवलोकन CVE विवरण विशेषताएँ टूलकिट घटक आवश्यकताएँ स्थापना उपयोग कार्यप्रवाह उदाहरण सुरक्षा संबंधी विचार समस्या निवारण योगदान अवलोकन यह टूलकिट...

CVE-2023-44487

CVE-2023-44487 Basic vulnerability scanning to see if web servers may be vulnerable to CVE-2023-44487 This tool checks to see if a website is vulnerable to CVE-2023-44487 completely non-invasively. 1. The tool checks if a web server accepts HTTP/2 requests without downgrading them 2. If the web...

cont-flood-poc

...

Proof-of-Concept-POC---CVE-2026-49975-HTTP-2-Bomb-

CVE-2026-49975 - HTTP/2 Bomb अवधारणा का प्रमाण विवरण CVE-2026-49975, जिसे HTTP/2 Bomb के नाम से भी जाना जाता है, एक रिमोट डिनायल ऑफ सर्विस DoS भेद्यता है जो अपनी डिफ़ॉल्ट HTTP/2 कॉन्फ़िगरेशन में अधिकांश प्रमुख वेब सर्वरों को प्रभावित करती है। यह भेद्यता OpenAI Codex द्वारा एक दशक से ज्ञात दो...

CVE-2026-23918-Double-free-Apache-httpd-mod_http2

CVE-2026-23918 - Apache httpd modhttp2 PoC This repository contains a proof-of-concept implementation written in Go for a pre-authentication memory corruption scenario affecting Apache httpd with modhttp2. The code in this repository demonstrates a spray-and-trigger approach against a vulnerable...

cve-2026-49975-http2bomb_reproduction

CVE-2026-49975 HTTP/2 Bomb Complete Reproduction Guide Based on QiAnXin CERT Advisory + Calif Original Research ================================================================ I. Vulnerability Overview CVE-2026-49975 is a critical denial-of-service DoS vulnerability in HTTP/2 server and proxy...