manisso/http2-bombProof of Concept (PoC) for CVE-2026-49975 – HTTP/2 server memory exhaustion attack leveraging HPACK amplification and connection retention (HTTP/2 Slowloris).
A denial-of-service (DoS) proof of concept targeting HTTP/2 servers. By combining HPACK amplification with stream retention, a single machine with a modest network connection can render a vulnerable server unavailable within seconds.
CVE-2026-49975mod_http2 module of Apache HTTP Server allows a denial-of-service attack through specially crafted HTTP requests.The exploit proceeds through several stages, as illustrated by its execution logs:
TCP/TLS Connection Establishment
Multiple concurrent TCP/TLS connections are opened to the target server.
HTTP/2 Negotiation The client detects the maximum number of concurrent streams allowed by the server (typically 100 or 128).
HPACK Priming
Carefully crafted HTTP headers are sent to force the server to allocate excessively large HPACK compression tables, rapidly increasing memory consumption.
Connection Retention
Once the streams have been opened, the connections remain alive indefinitely, preventing the allocated memory from being released and eventually exhausting the server's available RAM.
Testing was performed against multiple web servers using their default configurations.
| Web Server | Tested Version | RAM | Memory Exhaustion | Observed Behavior |
|---|---|---|---|---|
| Envoy | 1.37.2 | 32 GB | ~10 seconds | Successfully exhausted memory very quickly. |
| Apache HTTP Server | 2.4.67 | 32 GB | ~18 seconds | Stream limit typically 100. Standard attack progression through HPACK priming and indefinite connection retention. |
| nginx | 1.29.7 | 32 GB | ~45 seconds | Stream limit typically 128. Attack succeeds but requires more time to consume available memory. |
| Microsoft IIS | Not specified | 64 GB | ~45 seconds | May advertise unusually large stream limits such as 4294967297. |
| Non-vulnerable Targets | Various | - | - | Immediate TLS failures or TooManyStreamsError when attempting to exceed the server's configured stream limit. |
h2.exceptions.TooManyStreamsErrorOccurs when the value supplied to --streams exceeds the maximum concurrent streams supported by the server.
Solution: Probe the server's stream limit before starting the attack.
NameError: name 'SettingsAcknowledued' is not definedA simple typographical error in the PoC source code.
Solution: Replace:
SettingsAcknowledued
with:
SettingsAcknowledged
[SSL] unknown errorUsually indicates that the target does not support HTTP/2 over TLS or is rejecting incoming connections.
EOF occurred in violation of protocolThe remote server closed the connection unexpectedly.
This commonly occurs when the server begins to exhaust its resources and starts refusing new connections.
Invalid input ConnectionInputs.SEND_HEADERSThe server closed the HTTP/2 connection before all request headers could be transmitted.
The proof of concept is implemented as a Python script.
git clone https://github.com/califio/http2-bomb.git
cd http2-bomb
python3 -m venv venv
source venv/bin/activate
pip install -r requirements.txt
Basic attack using 10 connections and 100 streams:
python bomb.py example.com --streams 100 --connections 10
(Requires the target to allow at least 100 concurrent streams per connection.)
Automatic stream limit detection:
python bomb.py example.com --connections 10
Large-scale attack:
python bomb.py target.example.com --connections 50
High-volume connection test:
python h2bomb.py -t target.example.com:443 -c 1000
Very large-scale connection test:
python h2bomb.py -t example.com -c 20000
This software is provided exclusively for security research, educational purposes, and testing systems for which you have explicit authorization.
Unauthorized use of this tool against systems you do not own or have permission to test may violate applicable laws and regulations. The authors and contributors assume no responsibility for any misuse or damage resulting from the use of this software.