CVE-2026-49975 is a memory exhaustion vulnerability in the HTTP/2 protocol implementation. The attack chain consists of two key steps:
HPACK Compression Bomb: Repeatedly sending the same header (e.g., x-bomb: test) within a single HTTP/2 stream forces the server to allocate a full memory structure for each reference, achieving a memory amplification ratio of over 4000:1.
Window Stall: Setting the initial flow control window to 0 prevents the server from sending responses, causing the allocated memory to be permanently locked and never released.
Combined, an attacker can make the server consume over 1 MB of memory by sending only about 16 KB of data, and can exhaust 32 GB of memory within tens of seconds, ultimately leading to a service crash.
🛠️ Tool Features
✅ Automatic HTTP/2 Detection: Determines whether the target supports h2/h2c via ALPN negotiation (HTTPS) or connection preface (cleartext). Does not attack if unsupported.
✅ One-Click Detection & Attack: Automatically completes the full process of "Detection → Memory Lock → DoS Overload".
✅ Forced Attack Mode: Skips detection and sends the attack payload directly (suitable when the target is known to support HTTP/2).
✅ Multi-Protocol Proxy Support: Supports HTTP, HTTPS, SOCKS4, and SOCKS5 proxies with configurable address and port.
✅ Adjustable Attack Intensity: Set "repetitions per request" (default 5) and "number of attack streams" (0 for infinite continuous attack).
✅ Graphical User Interface: Real-time log output, simple and intuitive operation.
🚀 Usage (Running the Binary Directly)
1. Run the Program
Double-click CVE-2026-49975_Exploit_v2.1.exe (Windows)
or
Execute in the command line: CVE-2026-49975_Exploit_v2.1.exe
2. Fill in Target Information
Target Host: IP or domain name (e.g., 192.168.1.100 or example.com)
Port: Typically 443 for HTTPS, 80 for cleartext HTTP/2
HTTPS: Checked indicates the target uses TLS (i.e., h2); unchecked means cleartext h2c
3. (Optional) Configure Proxy
Check "Enable Proxy"
Select proxy type (http/https/socks4/socks5)
Fill in proxy address and port
4. Set Attack Parameters
Repetitions per Request: Recommend keeping the default 5
Number of Attack Streams: 0 means infinite continuous attack; a positive number sends that many streams and stops automatically (e.g., 1000)
5. Execute the Attack
Recommended: Click "Detect & Attack" → auto-detect HTTP/2 → if supported, begin attack
Force Attack: Click "Force Attack" (skips detection, suitable when the target is confirmed to support HTTP/2)
6. Stop the Attack
Click the "Stop Attack" button at any time to terminate
7. Verify Attack Effects
Target server memory usage spikes (observe using htop, free -h, docker stats)
Web service eventually becomes unresponsive or crashes; tool logs show errors like Connection reset by peer
⚠️ Disclaimer
This tool is for authorized security testing only. Do not run it on any production or unauthorized system without written permission from the target system owner.
All direct or indirect consequences (including but not limited to service interruption, data loss, legal liability) caused by using this tool are borne by the user.
The author (polar bear) and distributors assume no liability. Running this tool indicates that you have read and agreed to this disclaimer.
lsg-polarbear/cve-2026-49975
