http2-bomb

HTTP/2 爆弾 — CVE-2026-49975 HTTP/2 ストリーム増幅 PoC · Docker · Webコンソール 脆弱性 HTTP/2 は単一のTCP接続で複数のストリームを多重化できます。このPoCは、多数の内部参照を含む特別に形成されたHEADERSフレームを作成し、サーバーがそれらを追跡するために大量のメモリを割り当てるように強制します。...

Proof-of-Concept-POC---CVE-2026-49975-HTTP-2-Bomb-

CVE-2026-49975 - HTTP/2 Bomb 概念実証 説明 CVE-2026-49975（別名 HTTP/2 Bomb ）は、ほとんどの主要なWebサーバーのデフォルトのHTTP/2設定に影響を与えるリモートサービス拒否（DoS）脆弱性です。 この脆弱性は、OpenAI Codex によって、10年前から知られている2つの技術を組み合わせて発見されました： HPACK Bomb : ネットワーク上の1バイトがサーバー上で完全なヘッダー割り当てに変換されます Slowloris式ホールド : メモリ解放を防ぐゼロバイトのフロー制御ウィンドウ 影響を受けるサーバー...

CVE-2026-49975

CVE-2026-49975 HTTP/2 爆弾再現ツール 作者 : polar bear バージョン : 2.1 対象脆弱性 : CVE-2026-49975（HTTP/2 プロトコルメモリ爆弾） 📖 脆弱性の原理 CVE-2026-49975 は HTTP/2 プロトコル実装におけるメモリ枯渇脆弱性であり、攻撃チェーンは以下の2つの重要なステップで構成されます： 1. HPACK圧縮爆弾 ：単一のHTTP/2ストリームで同じヘッダー（例：x-bomb: test）を繰り返し送信し、サーバーに各参照に対して完全なメモリ構造を割り当てさせ、4000:1以上のメモリ増幅 を実現します。 2...

Important: Red Hat Security Advisory: mod_http2 security update

An update for modhttp2 is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Vulnerability in Cosminexus HTTP Server

Overview VulnerabilityCVE-2026-49975 has been found in Cosminexus HTTP Server. This vulnerability does not apply if HTTP/2 protocol is disabled. Impact Regarding the impact of the vulnerability, please refer to the vendor advisory. Solution Please refer to the 'Vendor Information' section for the...

Photon OS 5.0: Httpd PHSA-2026-5.0-91-0881

An update of the httpd package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-91-0881. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Oracle Linux 10 : mod_http2 (ELSA-2026-25225)

The remote Oracle Linux 10 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-25225 advisory. - Resolves: RHEL-188008 - address CVE-2026-43951, CVE-2026-48913 - Resolves: RHEL-182410 - modhttp2: HTTP/2: Remote Denial of Service via compression bomb and...

MiracleLinux 9 : mod_http2-2.0.26-6.el9_8.1 (AXSA:2026-1306:02)

The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-1306:02 advisory. httpd: HTTP/2: Remote Denial of Service via compression bomb and Slowloris-style attack CVE-2026-49975 Tenable has extracted the preceding description block...

Important: Red Hat Security Advisory: httpd:2.4 security update

An update for the httpd:2.4 module is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Commo...

Important: Red Hat Security Advisory: httpd:2.4 security update

An update for the httpd:2.4 module is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerabilit...

SUSE SLED15: apache2 / apache2-devel / apache2-event / apache2-manual / etc (SUSE-SU-2026:2759-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2759-1 advisory. This update for apache2 fixes the following issues - CVE-2026-29167: modldap per-dir use-after-free bsc1267976...

SUSE-SU-2026:2717-1 Security update for apache2

This update for apache2 fixes the following issues - CVE-2026-29167: modldap per-dir use-after-free bsc1267976. - CVE-2026-29170: modproxyftp XSS bsc1267977. - CVE-2026-34355: modproxyhtml buffer overflow bsc1267978. - CVE-2026-34356: malicious backend servers can lead to a heap-based buffer...

mod_http2 security update

2.0.26-6.1 - Resolves: RHEL-182417 - modhttp2: HTTP/2: Remote Denial of Service via compression bomb and Slowloris-style attack CVE-2026-49975 2.0.26-6 - Resolves: RHEL-166293 - httpd: Apache HTTP Server: HTTP/2 DoS by Memory Increase CVE-2025-53020...

Important: Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.62 SP4 security update

Red Hat JBoss Core Services Apache HTTP Server 2.4.62 Service Pack 4 is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Important: mod_http2

Issue Overview: Denial of service in HTTP/2 cookie request header counting CVE-2026-49975 Affected Packages: modhttp2 Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories. Issue Correction: Ru...

USN-8398-3: nginx vulnerability

USN-8398-1 fixed a vulnerability in nginx. The update caused a regression and was temporarily reverted in USN-8398-2. This update introduces a complete fix for CVE-2026-49975. We apologize for the inconvenience. Original advisory details: It was discovered that nginx incorrectly handled certain...

MiracleLinux 8 : httpd:2.4 (AXSA:2026-786:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-786:01 advisory. httpd: HTTP/2: Remote Denial of Service via compression bomb and Slowloris-style attack CVE-2026-49975 Tenable has extracted the preceding description block...

AlmaLinux 10 : mod_http2 (ALSA-2026:25225)

The remote AlmaLinux 10 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:25225 advisory. httpd: HTTP/2: Remote Denial of Service via compression bomb and Slowloris-style attack CVE-2026-49975 Tenable has extracted the preceding description block...

Exploit for Memory Allocation with Excessive Size Value in Apache Http_Server

http2-bomb-detector HTTP/2 Bomb CVE-2026-49975 Non-destru...

RLSA-2026:25225 Important: mod_http2 security update

The modh2 Apache httpd module implements the HTTP2 protocol h2+h2c on top of libnghttp2 for httpd 2.4 servers. Security Fixes: httpd: HTTP/2: Remote Denial of Service via compression bomb and Slowloris-style attack CVE-2026-49975 For more details about the security issues, including the impact, a...