Author: polar bear
Version: 2.1
Applicable Vulnerability: CVE-2026-49975 (HTTP/2 Protocol Memory Bomb)
📖 Vulnerability Principle
CVE-2026-49975 is a memory exhaustion vulnerability in the HTTP/2 protocol implementation. The attack chain consists of two key steps:
- HPACK Compression Bomb: Repeatedly sending the same header (e.g.,
x-bomb: test) within a single HTTP/2 stream forces the server to allocate a full memory structure for each reference, achieving a memory amplification ratio of over 4000:1.
- Window Stall: Setting the initial flow control window to 0 prevents the server from sending responses, causing the allocated memory to be permanently locked and never released.
Combined, an attacker can make the server consume over 1 MB of memory by sending only about 16 KB of data, and can exhaust 32 GB of memory within tens of seconds, ultimately leading to a service crash.
- ✅ Automatic HTTP/2 Detection: Determines whether the target supports
h2/h2c via ALPN negotiation (HTTPS) or connection preface (cleartext). Does not attack if unsupported.
- ✅ One-Click Detection & Attack: Automatically completes the full process of "Detection → Memory Lock → DoS Overload".
- ✅ Forced Attack Mode: Skips detection and sends the attack payload directly (suitable when the target is known to support HTTP/2).
- ✅ Multi-Protocol Proxy Support: Supports HTTP, HTTPS, SOCKS4, and SOCKS5 proxies with configurable address and port.
- ✅ Adjustable Attack Intensity: Set "repetitions per request" (default 5) and "number of attack streams" (0 for infinite continuous attack).
- ✅ Graphical User Interface: Real-time log output, simple and intuitive operation.
🚀 Usage (Running the Binary Directly)
1. Run the Program
- Double-click
CVE-2026-49975_Exploit_v2.1.exe (Windows)
or
Execute in the command line: CVE-2026-49975_Exploit_v2.1.exe
- Target Host: IP or domain name (e.g.,
192.168.1.100 or example.com)
- Port: Typically
443 for HTTPS, 80 for cleartext HTTP/2
- HTTPS: Checked indicates the target uses TLS (i.e.,
h2); unchecked means cleartext h2c
- Check "Enable Proxy"
- Select proxy type (
http/https/socks4/socks5)
- Fill in proxy address and port
4. Set Attack Parameters
- Repetitions per Request: Recommend keeping the default
5
- Number of Attack Streams:
0 means infinite continuous attack; a positive number sends that many streams and stops automatically (e.g., 1000)
5. Execute the Attack
- Recommended: Click "Detect & Attack" → auto-detect HTTP/2 → if supported, begin attack
- Force Attack: Click "Force Attack" (skips detection, suitable when the target is confirmed to support HTTP/2)
6. Stop the Attack
- Click the "Stop Attack" button at any time to terminate
7. Verify Attack Effects
- Target server memory usage spikes (observe using
htop, free -h, docker stats)
- Web service eventually becomes unresponsive or crashes; tool logs show errors like
Connection reset by peer
⚠️ Disclaimer
- This tool is for authorized security testing only. Do not run it on any production or unauthorized system without written permission from the target system owner.
- All direct or indirect consequences (including but not limited to service interruption, data loss, legal liability) caused by using this tool are borne by the user.
- The author (polar bear) and distributors assume no liability. Running this tool indicates that you have read and agreed to this disclaimer.
📄 Version History
- v2.1 (2026-06-11): Fixed UI freeze issue (thread-safe UI updates), improved stability.
- v2.0 (2026-06-11): Added automatic HTTP/2 detection, multi-protocol proxy support, one-click detection and attack.
- v1.0 (2026-06-10): Basic graphical interface, support for Lock/DoS modes.
Happy Hacking, but stay legal! 🐻❄️
lsg-polarbear/cve-2026-49975
