Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
Proof-of-Concept-POC---CVE-2026-49975-HTTP-2-Bomb- — Proof-of-concept exploit for CVE-2026-49975 (HTTP/2 Bomb), a remote denial-of-service vulnerability affecting major web servers via HPACK bomb and Slowloris-style memory exhaustion. | Kitploit
Tools/GitHubGitHub/fevar54/proof-of-concept-poc---cve-2026-49975-http-2-bomb-
Vulnerability AnalysisExploitationWeb SecurityNetwork SecurityPenetration Testing
GitHubfevar54/proof-of-concept-poc---cve-2026-49975-http-2-bomb-

Proof-of-Concept-POC---CVE-2026-49975-HTTP-2-Bomb-

Proof-of-concept exploit for CVE-2026-49975 (HTTP/2 Bomb), a remote denial-of-service vulnerability affecting major web servers via HPACK bomb and Slowloris-style memory exhaustion.

View Repository
6263 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2026-49975 - HTTP/2 Bomb Proof of Concept

Critical CVE

Description

CVE-2026-49975, also known as HTTP/2 Bomb, is a remote denial-of-service (DoS) vulnerability that affects most major web servers in their default HTTP/2 configuration.

The vulnerability was discovered by OpenAI Codex by combining two techniques known for a decade:

  • HPACK Bomb: One byte on the network turns into a full header allocation on the server
  • Slowloris-style hold: Zero-byte flow control window that prevents memory from being freed

Affected Servers

ServerAffected VersionsStatus
nginx< 1.29.8✅ Patched
Apache httpd< mod_http2 v2.0.41✅ Patched
Microsoft IISRecent versions❌ Unpatched
EnvoyRecent versions❌ Unpatched
Cloudflare PingoraRecent versions❌ Unpatched

Amplification per Server

ServerAmplification FactorImpact
Envoy 1.37.2~5,700:132 GB in ~10s
Apache httpd 2.4.67~4,000:132 GB in ~18s
nginx 1.29.7~70:132 GB in ~45s
IIS (2025)~68:164 GB in ~45s

Attacker Requirements

  • A home computer with a 100 Mbps connection
  • Ability to render a vulnerable server inaccessible in seconds
  • Knowledge that more than 880,000 websites are potentially vulnerable

Proof of Concept

Installation

root@kitploit:~
git clone https://github.com/tenable-cve/CVE-2026-49975.git
cd CVE-2026-49975
pip install -r requirements.txt
Download Tool