CVE-2026-49975

This repository contains a functional Python-based PoC for CVE-2026-49975, an HTTP/2 Bomb vulnerability that exploits HPACK index-reference amplification combined with HTTP/2 flow-control stalling to trigger memory exhaustion on vulnerable servers. The exploit sends crafted HTTP/2 frames to induce excessive memory allocation and stall responses, leading to a denial-of-service condition.

This repository contains a functional proof-of-concept exploit for CVE-2026-49975, an HTTP/2 denial-of-service vulnerability. The exploit leverages HPACK indexed references and flow-control window manipulation to exhaust server memory, targeting vulnerabilities in nginx, Apache httpd, Envoy, and other HTTP/2 implementations.

This repository contains a functional proof-of-concept exploit for CVE-2026-49975, an HTTP/2 Bomb vulnerability that combines HPACK Bomb and Slowloris-style techniques to cause a denial-of-service (DoS) by consuming server memory. The exploit includes a Python script that crafts malicious HTTP/2 frames to trigger the vulnerability, along with detection scripts and a Docker lab for testing.

This repository provides a detailed technical explanation of CVE-2026-49975, an HTTP/2 vulnerability affecting major web servers like Apache, nginx, and Envoy. It describes the attack mechanism combining HPACK compression bombs and window stalling to cause memory exhaustion and DoS.

This repository contains a non-destructive detection script for CVE-2026-49975, an HTTP/2 HPACK compression bomb vulnerability affecting Nginx and Apache httpd. The script sends minimal probe requests (refs=3) to analyze server responses and determine vulnerability status without causing denial-of-service.

This repository contains a non-destructive detection script for CVE-2026-49975, an HTTP/2 Bomb vulnerability affecting Nginx and Apache httpd. It sends minimal probe packets to analyze server responses and determine vulnerability status without causing actual harm.

This repository contains a detailed technical analysis of CVE-2026-49975, an HTTP/2 Bomb vulnerability affecting major web servers. It explains the attack mechanism, including HPACK indexed-reference amplification and flow-control window stalling, and provides in-depth analysis of the vulnerability's impact and mitigation strategies.

This repository contains a functional HTTP/2 stream amplification PoC targeting CVE-2026-49975, which exploits memory exhaustion via crafted HEADERS frames with excessive internal references. The tool includes a web interface for launching attacks and monitoring results.

This PoC exploits CVE-2026-49975, a memory exhaustion vulnerability in Apache HTTP Server's mod_http2 module. The attack combines HPACK header amplification with HTTP/2 stream retention to rapidly deplete server memory by forcing excessive allocations in the HPACK compression tables and maintaining open streams indefinitely.

This repository contains a functional exploit PoC for CVE-2026-49975, a DoS vulnerability in Apache HTTP Server's HTTP/2 handling. The exploit uses HPACK-encoded headers to force excessive memory allocation during cookie header merging, combined with flow control to delay responses and sustain memory consumption.

This repository contains a functional Python-based PoC for CVE-2026-49975, an HTTP/2 Bomb DoS vulnerability. It exploits HPACK indexed reference bombs combined with flow-control window stalling to exhaust server memory.

This repository contains a non-destructive detection script for CVE-2026-49975, an HTTP/2 HPACK compression memory exhaustion vulnerability affecting Nginx and Apache httpd. The tool sends minimal probe requests (refs=3) to analyze server responses and determine vulnerability status without causing denial of service.

This repository contains a functional HTTP/2 denial-of-service exploit for CVE-2026-49975, leveraging HPACK compression bombs, slowloris flow control, and cookie fragmentation to exhaust server memory. The PoC includes both an attack script and a vulnerable test server for validation.

This repository provides a detailed technical explanation of CVE-2026-49975, an HTTP/2 vulnerability affecting major web servers like Apache, nginx, and Envoy. It describes the attack mechanism combining HPACK compression bombs and window stalling to cause memory exhaustion and DoS.

This repository contains a detection script for CVE-2026-49975, which identifies HTTP/2-enabled servers and flags potential exposure to the 'HTTP/2 Bomb' vulnerability. It does not exploit the vulnerability but scans for affected software versions and HTTP/2 support.