
Proof-of-concept exploit for CVE-2026-49975 (HTTP/2 Bomb), a remote denial-of-service vulnerability affecting major web servers via HPACK bomb and Slowloris-style memory exhaustion.
CVE-2026-49975, also known as HTTP/2 Bomb, is a remote denial-of-service (DoS) vulnerability that affects most major web servers in their default HTTP/2 configuration.
The vulnerability was discovered by OpenAI Codex by combining two techniques known for a decade:
| Server | Affected Versions | Status |
|---|
| nginx | < 1.29.8 | ✅ Patched |
| Apache httpd | < mod_http2 v2.0.41 | ✅ Patched |
| Microsoft IIS | Recent versions | ❌ Unpatched |
| Envoy | Recent versions | ❌ Unpatched |
| Cloudflare Pingora | Recent versions | ❌ Unpatched |
| Server | Amplification Factor | Impact |
|---|---|---|
| Envoy 1.37.2 | ~5,700:1 | 32 GB in ~10s |
| Apache httpd 2.4.67 | ~4,000:1 | 32 GB in ~18s |
| nginx 1.29.7 | ~70:1 | 32 GB in ~45s |
| IIS (2025) | ~68:1 | 64 GB in ~45s |
git clone https://github.com/tenable-cve/CVE-2026-49975.git
cd CVE-2026-49975
pip install -r requirements.txt