Proof-of-Concept-POC---CVE-2026-49975-HTTP-2-Bomb-

CVE-2026-49975 - HTTP/2 Bomb Proof of Concept Descripción CVE-2026-49975, también conocida como HTTP/2 Bomb , es una vulnerabilidad de denegación de servicio DoS remoto que afecta a la mayoría de los servidores web principales en su configuración HTTP/2 predeterminada. La vulnerabilidad fue...

cve-2026-49975-http2bomb_reproduction

CVE-2026-49975（HTTP/2 Bomb）完全再現ガイド 奇安信（QiAnXin）CERT アドバイザリ + Calif オリジナル研究に基づく ================================================================ I. 脆弱性の概要 CVE-2026-49975 は、HTTP/2 サーバーおよびプロキシ実装における重大なサービス拒否（DoS）脆弱性です。「HTTP/2 Bomb」または「HPACK Bomb」と呼ばれるこの攻撃は、HTTP/2 プロトコルの 2...

CVE-2026-49975-POC

CVE-2026-49975 — PoC de Bomba HTTP/2 Exploit de prueba de concepto para CVE-2026-49975, una vulnerabilidad remota de denegación de servicio en implementaciones de servidores HTTP/2. Descubierto por Quang Luong Calif Security Research, divulgado el 2 de junio de 2026. Solo para pruebas de segurida...

CVE-2026-49975

CVE-2026-49975 HTTP/2 Бомба PoC Инструмент для воспроизведения удаленной уязвимости отказа в обслуживании HTTP/2 Обзор уязвимости CVE-2026-49975 — это уязвимость отказа в обслуживании DoS в протоколе HTTP/2, затрагивающая популярные веб-серверы. Уязвимость была обнаружена компанией Calif с...

CVE-2026-49975

CVE-2026-49975 HTTP/2 Bomben-Exploit-Tool Autor : polar bear Version : 2.1 Betroffene Schwachstelle : CVE-2026-49975 HTTP/2-Protokoll-Speicherbombe 📖 Funktionsweise der Schwachstelle CVE-2026-49975 ist eine Speichererschöpfungsschwachstelle in der HTTP/2-Protokollimplementierung. Die Angriffskett...

CVE-2026-49975-HTTP-2-Bomb

A triage не эксплуатация инструмент для выявления поверхностей атак, подверженных CVE-2026-49975 — "HTTP/2 Bomb". ⚠️ Этот скрипт не отправляет эксплойты. Он выполняет только обычные HTTP-запросы и анализирует заголовки ответов, чтобы пометить хосты, требующие ручной проверки версии/патча. О...

CVE-2025-53020-PoC

CVE-2025-53020 - PoC di Esaurimento della Memoria HTTP/2 di Apache httpd Una proof of concept che dimostra CVE-2025-53020, una vulnerabilità di esaurimento della memoria nell'implementazione HTTP/2 di Apache httpd che ho trovato a metà 2025. 📖 Analisi approfondita :...

http4s has HTTP/2 Denial of Service with Ember Backend

Summary http4s 0.23.x and 1.0 servers running ember with http2 enabled are vulnerable to a denial of service attack using a HPACK bomb vulnerability recently disclosed as affecting other http2 servers. Impact Denial of Service: - Affects any http4s server running the ember backend with HTTP/2...

CVE-2026-54556

http4s (Scala HTTP library) versions prior to 0.23.35 and 1.0.0-M47 are vulnerable to an out-of-memory denial of service when using the Ember backend with HTTP/2 enabled. The root cause is a HPACK bomb : the Hpack wrapper concatenates HEADERS and CONTINUATION frame fragments into a single decoded...

CVE-2026-49975

CVE-2026-49975 HTTP/2 Bomb ★ CVE-2026-49975 HTTP/2 Bomb PoC ★ Panoramica CVE-2026-49975 è una vulnerabilità Denial of Service DoS in Apache HTTP Server. La vulnerabilità si verifica nel percorso di gestione delle richieste HTTP/2, dove più campi header cookie possono essere uniti senza essere...

http2-bomb-analysis-paper

HTTP/2 Bomb: Ataque em Cadeia de Amplificação de Referência Indexada HPACK Um mergulho técnico independente de um estudante de ensino médio Junho de 2026 TL;DR Este repositório contém minha análise completa da vulnerabilidade HTTP/2 Bomb CVE-2026-49975 / CVE-2026-47774, que encadeia duas primitiv...

http2-bomb-detector

http2-bomb-detector Strumento di rilevamento non distruttivo della vulnerabilità HTTP/2 Bomb CVE-2026-49975 — per Nginx / Apache httpd Contesto della vulnerabilità CVE-2026-49975 è una vulnerabilità diffusa di denial of service remoto a livello di protocollo HTTP/2, scoperta dal ricercatore di...

http2-bomb

HTTP/2 Bomb - CVE-2026-49975 Ein Denial-of-Service DoS-Proof-of-Concept, das auf HTTP/2-Server abzielt. Durch die Kombination von HPACK-Verstärkung mit Stream-Retention kann ein einzelner Rechner mit einer bescheidenen Netzwerkverbindung einen anfälligen Server innerhalb von Sekunden unerreichbar...

cowlib: Cowlib: Denial of Service due to unbounded HPACK/QPACK prefixed-integer decoding

A flaw was found in cowlib, an HTTP parser. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 frames containing oversized HPACK or QPACK prefixed integers. This unbounded decoding process leads to excessive memory allocation and...

CVE-2026-75484 HTTP/2 header field values containing CR, LF or NUL are passed to the application unvalidated in Bandit

Improper Neutralization of CRLF Sequences 'CRLF Injection' vulnerability in mtrudel bandit allows an unauthenticated remote attacker to smuggle CR, LF, or NUL characters into application-visible request headers via HTTP/2. Bandit.HTTP2.Stream.readheaders/1 validates pseudo-header placement and...

httpd: httpd: HTTP/2 Remote Denial of Service via compression bomb and Slowloris-style attack

A flaw was found in HTTP/2, affecting various web servers. A remote attacker can exploit this vulnerability by combining an HPACK compression bomb with a zero-byte flow-control window. This technique allows a small amount of data to expand into large memory allocations on the server, which are th...

haproxy security update

An update is available for haproxy. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The haproxy packages provide a reliable, high-performance network load...

haproxy security update

An update is available for haproxy. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The haproxy packages provide a reliable, high-performance network load balanc...

RLSA-2026:55772 Important: haproxy security update

The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications. Security Fixes: haproxy: HAProxy: Denial of Service via HPACK dynamic table insertions CVE-2026-55204 haproxy: HAProxy: Response smuggling due to integer overflow in FastCGI record...

RLSA-2026:55859 Important: haproxy security update

The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications. Security Fixes: haproxy: HAProxy: Denial of Service via HPACK dynamic table insertions CVE-2026-55204 For more details about the security issues, including the impact, a CVSS score...