EQSTLab/CVE-2026-49975

GitHubRepository PoCExploit

PoC files

4 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a Python script (poc.py) that implements a denial-of-service exploit against Apache HTTP Server's mod_http2. It crafts HPACK-encoded HTTP/2 requests with many cookie header references, causing excessive memory allocation during cookie merging, and uses flow control to keep connections open and memory unreleased.

Backdoor review

No backdoor observed in reviewed code

The repository contains a proof-of-concept (PoC) for CVE-2026-49975, a denial-of-service vulnerability in Apache HTTP Server. The supplied text files (Dockerfile, README.md, poc.py) describe and implement a legitimate HTTP/2 HPACK cookie bomb attack against a vulnerable Apache server. No backdoor, trojan, or deceptive payload targeting the person running the PoC was observed. The code performs only the documented DoS attack and standard HTTP/2 connection handling.

ClassificationExploit
Model confidence98%
AuthenticationNot required
LanguagesPython
Target softwareApache HTTP Servermod_http2
Attack typesDenial of ServiceMemory Exhaustion
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact poc.py contains code that actively exercises the vulnerability by sending malicious HTTP/2 requests to cause memory exhaustion and denial of service. It is not merely detecting or reporting the vulnerability; it is exploiting it.

poc.py:1-365README.md:45-71

Requirements

  • Target must be running a vulnerable version of Apache HTTP Server (2.4.17 through 2.4.67) with mod_http2 enabled and h2c direct mode configured.README.md:24-25Dockerfile:1-14
  • Network access to the target HTTP/2 service.poc.py:204-205

Observed behavior

  • Establishes multiple HTTP/2 connections using h2c direct mode.poc.py:204-221
  • Sends HPACK-encoded header blocks that expand into many cookie header fields on the server, causing repeated memory allocation during cookie merging.poc.py:76-90poc.py:257-258
  • Uses HTTP/2 flow control (initial window size of 0 and periodic small window updates) to delay response transmission, keeping streams open and preventing memory release.poc.py:92-94poc.py:229-240poc.py:286-303
  • Maintains connections for a configurable hold duration to sustain memory pressure.poc.py:286-303
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Vulnerability Exploit
CVE-2026-49975The PoC targets a known Apache HTTP Server DoS vulnerability via HTTP/2 HPACK cookie header amplification.README.md:12-15poc.py:75-90
Network Behavior
HTTP/2 h2c direct connection to attacker-specified host and portThe PoC connects to a user-supplied target to send the DoS payload. This is expected exploit behavior, not a backdoor.poc.py:204-221poc.py:244-249
Command Line Interface
python3 poc.py --host TARGET_IP --port 10081 ...The README instructs the user to run the PoC against a target server. No hidden or deceptive commands are present.README.md:61-70
Review boundaries

What the analysis did not establish

  • One file (likely a video or image referenced in README.md) was omitted from the text evidence; its content is not available for analysis.
  • The evidence does not include the actual execution output or confirmation that the exploit was successfully run against a live target.
  • One binary file (user-attachments/assets/89310771-f704-45d1-a6c3-d910de1dbc74) was flagged as metadata-only and not analyzed. It is referenced as an image in the README and is not executed by the PoC.
  • The review covers only the supplied text evidence; no runtime analysis was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

1
GitHub

Repository root

Created Vuln labCVE-2026-49975Dockerfile

1 Dockerfile

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A single Dockerfile builds a vulnerable Apache HTTP Server 2.4.67 with HTTP/2 h2c direct mode enabled, intended as a target for CVE-2026-49975 denial-of-service reproduction. Two Python scripts (poc.py, check_server.py) are provided to exercise and monitor the vulnerability.

Dockerfile:1-18README.md:1-85

Lab assessment

Vulnerability lab

The README explicitly describes CVE-2026-49975, lists affected versions, provides build/run commands for a vulnerable Apache container, and includes PoC steps. The Dockerfile configures Apache with h2c direct mode and the vulnerable version 2.4.67. The Python scripts implement the attack and a monitoring probe, consistent with a vulnerability reproduction lab.

README.md:3-7README.md:9-17README.md:29-33Dockerfile:1-18
Lab shapeDockerfile
ServicesUnknown
Compose manifests0
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

Apache HTTP Server (httpd:2.4.67)

vulnerable target

Base image httpd:2.4.67 is modified to enable mod_http2 and h2c direct mode, exposing port 80. It serves as the DoS target for the CVE-2026-49975 exploit.

Dockerfile:1-18README.md:9-17

poc.py

exploit script

Python script that establishes multiple HTTP/2 h2c connections, sends HPACK-encoded header blocks with many Cookie header references to trigger memory amplification, and uses flow-control window updates to hold streams open, demonstrating the DoS.

poc.py:1-365README.md:37-52

check_server.py

monitoring probe

Python script that periodically sends normal HTTP/1.1 GET requests to the target and logs response status and latency, used to observe the impact of the DoS attack on legitimate users.

check_server.py:1-89README.md:1-85
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2026-49975

Supported by supplied evidence

The README describes CVE-2026-49975 as a DoS in Apache HTTP Server 2.4.17–2.4.67 due to improper counting of merged Cookie headers. The Dockerfile uses httpd:2.4.67 and enables h2c direct mode. The PoC script sends HPACK-encoded requests with many Cookie header references and uses flow control to hold streams open, matching the described vulnerability mechanism.

README.md:9-17Dockerfile:1-18poc.py:75-90poc.py:92-100
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker must be installed to build and run the vulnerable Apache container.README.md:29-33
  • Python 3 must be available to execute poc.py and check_server.py.poc.py:1check_server.py:1
  • The attacker must have network access to the target container's port (mapped to host port 10081).README.md:31poc.py:255

Evidence-described exercise path

  1. Build the Docker image: docker build -t cve-2026-49975 .README.md:30
  2. Run the container with memory limit and port mapping: docker run -d --name cve-2026-49975 --memory 8g -p 10081:80 cve-2026-49975README.md:31
  3. Monitor server memory usage: docker stats cve-2026-49975README.md:37-39
  4. Run the PoC script: python3 poc.py --host TARGET_IP --port 10081 --connections 10 --streams 100 --refs 4091 --initial-window 0 --hold 300 --drip-interval 2 --drip-bytes 1README.md:43-52
  5. Confirm memory usage increases and remains high while attack streams are held open.README.md:54-55
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior targets the lab's own Apache container. The Dockerfile only enables HTTP/2 and h2c. The PoC script connects to the lab container, sends crafted HTTP/2 requests, and manipulates flow control to demonstrate memory exhaustion. The probe script monitors the same container. No evidence of host escape, external connections, persistence, credential theft, or destructive actions outside the lab target.

Dockerfile:1-18poc.py:1-365check_server.py:1-89
Review boundaries

What the analysis did not establish

  • The packet does not include a Compose file; the environment is a single Dockerfile with no orchestration details.
  • The PoC script references a path '/big.bin' (default) that is not created in the Dockerfile; the lab may require additional setup not shown.
  • The README mentions a video asset and external analysis links that are not included in the evidence packet.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

1