Proof-of-Concept-POC---CVE-2026-49975-HTTP-2-Bomb-

CVE-2026-49975 - HTTP/2 Bomb Proof of Concept Description CVE-2026-49975, also known as HTTP/2 Bomb , is a remote denial-of-service DoS vulnerability that affects most major web servers in their default HTTP/2 configuration. The vulnerability was discovered by OpenAI Codex by combining two...

CVE-2026-49975-POC

CVE-2026-49975 — HTTP/2 Bomb PoC Proof-of-concept exploit for CVE-2026-49975, a remote denial-of-service vulnerability in HTTP/2 server implementations. Discovered by Quang Luong Calif Security Research, disclosed June 2, 2026. For authorized security testing only. Do not use against infrastructu...

RedGuard

RedGuard - Excellent C2 Front Flow Control tool English | 中文文档 0x00 Introduction What is RedGuard RedGuard, a derivative tool based on command and control C2 front flow control technology, has a lighter design, efficient traffic interaction, and reliable compatibility with development in the go...

CVE-2026-123635

The elixir-grpc grpc_server component (versions 1.0.0 to before 1.1.0) is vulnerable to a Missing Release of Resource after Effective Lifetime (CWE-772) flaw in the grpc_stream_h handler. When a server refuses a call early (e.g., due to max_body_size limits), Cowboy drops in-flight DATA frames wi...

EEF-CVE-2026-123635 Refused calls drain the HTTP/2 connection flow-control window in elixir-grpc grpc_server

Summary Missing Release of Resource after Effective Lifetime vulnerability in elixir-grpc grpcserver allows a client to stall all later calls on a shared HTTP/2 connection via calls that the server refuses while their DATA frames are in flight. The stream handler grpcstreamh...

fides

Securing AI Agents with Information-Flow Control This repository contains a Jupyter notebook to accompany the academic paper "Securing AI Agents with Information-Flow Control". The notebook is structured as a tutorial to walk readers through the concepts introduced in the paper. This illustrates ...

cve-2026-49975-http2bomb_reproduction

CVE-2026-49975 HTTP/2 Bomb Complete Reproduction Guide Based on QiAnXin CERT Advisory + Calif Original Research ================================================================ I. Vulnerability Overview CVE-2026-49975 is a critical denial-of-service DoS vulnerability in HTTP/2 server and proxy...

POC-CVE-2026-49975

-red CVE-2026-49975 HTTP/2 Bomb — HPACK Compression Bomb + Flow-Control Hold PoC Security Research PoC by naheeju ⚠️ This is a working, memory-exhaustion DoS tool — not a toy. It opens streams that force the target to allocate memory and holds them open via HTTP/2 flow-control tricks. As long as...

http2-bomb-analysis-paper

HTTP/2 Bomb: HPACK Indexed-Reference Amplification Chain Attack A high school student's independent technical deep-dive June 2026 TL;DR This repository contains my complete analysis of the HTTP/2 Bomb vulnerability CVE-2026-49975 / CVE-2026-47774, which chains two decades-old HTTP/2 primitives:...

http2-bomb-detector

http2-bomb-detector HTTP/2 Bomb CVE-2026-49975 Non-destructive vulnerability detection tool — for Nginx / Apache httpd Vulnerability Background CVE-2026-49975 is a widespread remote denial-of-service vulnerability in the HTTP/2 protocol layer, discovered by security researcher Quang Luong. This...

CLEANSTART-2026-MX71962 HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a r...

Security vulnerability affects the zookeeper-operator package. The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered...

CVE-2026-49975

CVE-2026-49975 HTTP/2 Bomb PoC HTTP/2 Remote Denial of Service Vulnerability Replication Tool Vulnerability Overview CVE-2026-49975 is an HTTP/2 denial of service vulnerability affecting major web servers. The vulnerability was discovered by security company Calif using OpenAI Codex in early June...

OESA-2026-4768 golang security update

. Security Fixes: During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of...

openssl: OpenSSL: Denial of Service via unenforced QUIC connection flow control

A flaw was found in OpenSSL. A remote attacker can cause a Denial of Service DoS due to missing connection-level flow control enforcement in the QUIC protocol implementation. By opening multiple streams that respect individual stream limits while preventing data consumption, the attacker can forc...

openssl: OpenSSL: Denial of Service via unenforced QUIC connection flow control

A flaw was found in OpenSSL. A remote attacker can cause a Denial of Service DoS due to missing connection-level flow control enforcement in the QUIC protocol implementation. By opening multiple streams that respect individual stream limits while preventing data consumption, the attacker can forc...

The Limits of Information-Flow Control Enforcement for Agentic Systems

Information-flow control IFC is a promising approach to enforce policy in agentic AI systems. However, IFC suffers from label creep, a phenomenon where monotonically increasing security labels propagate through a system and progressively limit its utility. Label creep in agentic AI systems can be...

openSUSE 16 Security Update : cadvisor (openSUSE-SU-2026:22218-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22218-1 advisory. Changes in cadvisor: - update vendor.tar to address: bsc1288588, CVE-2026-116591: github.com/klauspost/compress/zstd: crafted 27 KB two-block zs...

Security update for cadvisor (important)

openSUSE security update: security update for cadvisor ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22218-1 Rating: important References: bsc1288212 bsc1288588 Cross-References: CVE-2026-116591 CVE-2026-78663 CVSS scores: CVE-2026-116591 SUSE : 7...

CLEANSTART-2026-XV44707 HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a r...

Security vulnerability affects the rabbitmq-cluster-operator package. The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the...

OPENSUSE-SU-2026:22218-1 Security update for cadvisor

This update for cadvisor fixes the following issues: Changes in cadvisor: - update vendor.tar to address: bsc1288588, CVE-2026-116591: github.com/klauspost/compress/zstd: crafted 27 KB two-block zstd frame makes DecodeAll and the streaming decoder panic bsc1288212, CVE-2026-78663:...