Tomcat-CVE-2025-31650

CVE-2025-31650 🚨 Proof of Concept PoC for Apache Tomcat HTTP/2 DoS vulnerability CVE-2025-31650 This script triggers a memory exhaustion condition in Apache Tomcat by sending malformed priority headers over HTTP/2. 🎯 Affected Versions Apache Tomcat 9.0.76 – 9.0.102 Apache Tomcat 10.1.10 – 10.1.39...

CVE-2023-44487

HTTP/2 Rapid Reset: CVE-2023-44487 Description This repository contains proof-of-concept PoC code for the HTTP/2 Rapid Reset vulnerability identified as CVE-2023-44487. Vulnerability Overview CVE ID : CVE-2023-44487 Impact : Denial of Service DoS Affected Protocols : HTTP/2 Affected Components :...

CVE_2023_44487-Rapid_Reset

CVE-2023-44487 HTTP/2 Rapid Reset Testing Tool - Enhanced Edition A comprehensive Python testing tool for CVE-2023-44487 , the HTTP/2 Rapid Reset vulnerability. This repository contains both attack testing and verification-focused tools. ⚠️ IMPORTANT DISCLAIMER This tool is for educational and...

h2spacex

H2SpaceX HTTP/2 low level library based on Scapy which can be used for Single Packet Attack Race Condition on H2 This library was part of an academic research with title of QUIC-er Races: HTTP/3 won’t save you from TOCTOU vulnerabilities. Dive into Single Packet Attack Article I wrote an article...

h2csmuggler

h2cSmuggler Description h2cSmuggler smuggles HTTP traffic past insecure edge-server proxypass configurations by establishing HTTP/2 cleartext h2c communications with h2c-compatible back-end servers, allowing a bypass of proxy rules and access controls. See my detailed write-up below for: Technica...

CVE-2026-23918-Double-free-Apache-httpd-mod_http2

CVE-2026-23918 - Apache httpd modhttp2 PoC This repository contains a proof-of-concept implementation written in Go for a pre-authentication memory corruption scenario affecting Apache httpd with modhttp2. The code in this repository demonstrates a spray-and-trigger approach against a vulnerable...

bug-free-broccoli

cowlib HPACK/QPACK integer-decoder DoS — reproducible lab with observability The CVE A resource-limitation vulnerability in ninenines cowlib ≥ 2.0.0, 2.19.0 lets an unauthenticated remote HTTP/2 or HTTP/3 peer exhaust memory on the vulnerable server or client and cause a denial of service. The...

gori

A fast, keyboard-driven HTTP intercepting proxy and pentesting toolkit for the terminal built for humans and AI agents alike. Installation • Usage • Documentation • Contributing gori 고리 — Korean for ring, link, loop sits in the loop between your client and its target, capturing every request and...

Dos-exploit-

Dos-exploit- CVE-2025-31650 Exploit Title: Apache Tomcat 10.1.39 - Denial of Service DOS Author: Abdualhadi khalifa CVE: CVE-2025-31650 import httpx import asyncio import random import urllib.parse import sys import socket from colorama import init, Fore, Style init class TomcatKiller: def...

CVE-2026-22019-libcurl-HTTP-2-CONNECT-Tunnel-Mixup

CVE-2026-22019 – libcurl HTTP/2 CONNECT Tunnel Mixup Program Code C simulation // curlhttp2tunnelmixup.c - Simulated libcurl handling CONNECT over HTTP/2 include void handlehttp2streamint streamid // Vulnerability: after CONNECT, the proxy mixes streams with the tunneled data if streamid == 0...

http-request-smuggler

HTTP Request Smuggler This Burp Suite extension automatically detects and exploits HTTP Request Smuggling vulnerabilities using advanced desynchronization techniques developed by PortSwigger researcher James Kettle. It supports comprehensive scanning for HTTP/1.1 and HTTP/2-downgrade desync...

CVE-2026-49975

CVE-2026-49975 HTTP/2 Bomb Exploit Tool Author : polar bear Version : 2.1 Applicable Vulnerability : CVE-2026-49975 HTTP/2 Protocol Memory Bomb 📖 Vulnerability Principle CVE-2026-49975 is a memory exhaustion vulnerability in the HTTP/2 protocol implementation. The attack chain consists of two key...

CVE-2026-42945

CVE-2026-42945 PoC Go 中文 | English A detection and exploitation helper for nginx HTTP/2 CVE-2026-42945. Use it only in authorized environments to verify vulnerability presence, compare patched vs. vulnerable behavior, and reproduce PoC logic in a controlled lab. Affected versions heuristic: nginx...

tomcat-embed-core-9.0.31-CVE-2020-11996

Please see the PoC in testImplicitCloseLargeId unit test of TestHttp2Section51.java: https://github.com/rusakovichma/tomcat-embed-core-9.0.31-CVE-2020-11996/blob/master/test/org/apache/coyote/http2/TestHttp2Section51.java...

CVE-2026-49975-HTTP-2-Bomb

A triage not exploitation tool to identify attack surfaces exposed to CVE-2026-49975 — "HTTP/2 Bomb". ⚠️ This script does not send attack payloads. It only makes normal HTTP requests and analyzes response headers to flag hosts that warrant manual version/patch verification. About CVE-2026-49975...

http2-bomb-analysis-paper

HTTP/2 Bomb: HPACK Indexed-Reference Amplification Chain Attack A high school student's independent technical deep-dive June 2026 TL;DR This repository contains my complete analysis of the HTTP/2 Bomb vulnerability CVE-2026-49975 / CVE-2026-47774, which chains two decades-old HTTP/2 primitives:...

CVE-2026-11118-HTTP-2-Rapid-Reset-DDoS

CVE-2026-11118 – HTTP/2 Rapid Reset DDoS Program Code Python/http2 client + server http2serversim.py - Simple HTTP/2 server that processes reset streams import socket, ssl, h2.connection, h2.events def handle: sock = socket.socket sock.setsockoptsocket.SOLSOCKET, socket.SOREUSEADDR, 1...

nice-cve-poc

Nice CVE PoCs A collection of interesting CVE PoCs CVE-2023-44487 - HTTP/2 Rapid Reset Attack...

CVE-2024-52317

🚨🚨CVE-2024-52317🚨🚨 CVE-2024-52317 - Apache Tomcat HTTP/2 Data Leakage Vulnerability Overview CVE-2024-52317 is a vulnerability affecting Apache Tomcat's HTTP/2 implementation. The issue arises due to improper recycling of HTTP/2 request and response resources, potentially leading to data leakage...

CVE-2026-49975

CVE-2026-49975 HTTP/2 Bomb ★ CVE-2026-49975 HTTP/2 Bomb PoC ★ Overview CVE-2026-49975 is a Denial of Service DoS vulnerability in Apache HTTP Server. The vulnerability occurs in the HTTP/2 request handling path, where multiple cookie header fields can be merged without being properly counted...