1. Overview

CVE-2026-49975 ("HTTP/2 Bomb") is a remote, unauthenticated Denial-of-Service vulnerability affecting Apache HTTP Server's mod_http2 module. It chains two long-known HTTP/2 weaknesses:

1. HPACK bookkeeping bomb — a small, HPACK-encoded HTTP/2 request causes multiple Cookie header fragments to be merged without being counted against LimitRequestFields, forcing the server to repeatedly allocate memory for internal header bookkeeping structures.
2. Flow-control stall (Slowloris-style) — the client advertises a near-zero flow-control window, delaying response transmission and keeping the affected stream(s) open, which prevents the allocated memory from being released.

The result: a single client on a modest connection can force significant, sustained memory allocation on the target for as long as the stream is held open. This implementation supports two payload modes and scales linearly with the concurrency you configure:

• nginx mode — plants an empty x-bomb header in the HPACK dynamic table and re-references it repeatedly (~70:1 amplification per reference).
• classic mode — plants an oversized cookie header instead (~4000:1 amplification per reference).

Each connection re-references the planted header thousands of times per stream (--headers, default 5000), across multiple streams per connection (--streams, default 10) and multiple parallel connections (--threads, default 1). If the server closes a connection, the tool reconnects immediately and keeps going until manually stopped — this is a continuous-hold loop, not a single one-shot probe.

Related identifiers for other affected stacks (not implemented or tested by this repo):

• Envoy → CVE-2026-47774
• Microsoft IIS, Cloudflare Pingora → tracked separately, no CVE referenced here

Full scope of the underlying weakness class, for completeness — the "HTTP/2 Bomb" technique (HPACK compression bomb + flow-control hold) affects several server implementations beyond Apache. This repo only implements and tests the Apache case; the rest is included so readers understand the broader class, not because this PoC exercises them:

References (primary sources — verify all claims independently):

• CVE record: https://www.cve.org/CVERecord?id=CVE-2026-49975
• NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2026-49975
• Apache advisory / vulnerabilities list: https://httpd.apache.org/security/vulnerabilities_24.html
• Apache 2.4.68 changelog (fix commit reference): https://dlcdn.apache.org/httpd/CHANGES_2.4.68
• Original discovery writeup: https://blog.calif.io/p/codex-discovered-a-hidden-http2-bomb

2. Scope of This Repository

This repository contains:

• A minimal PoC script that reproduces the hold-only HPACK bomb behavior against a target you are authorized to test.
• This README, documenting the vulnerability, disclosure timeline, and safe-use conditions.

This repository does not contain:

• Any automation for scanning the internet for vulnerable hosts.
• Any flooding/DoS-sustain logic, concurrency ramp-up, or credential/target lists.
• Any code targeting a specific live system by default. Target must be explicitly supplied by the operator.

3. ⚖️ Legal & Ethical Notice

Read this before doing anything else.

• This PoC is published strictly for educational and defensive security research purposes — to help operators verify their own exposure and to support the public record of a already-disclosed, already-patched vulnerability.
• You must have explicit, documented authorization from the system owner before running this against any target that is not your own infrastructure or a system you are contractually/legally authorized to test (e.g., a signed pentest engagement, bug bounty scope, or written permission).
• Running this PoC against systems you do not own or have authorization to test — including but not limited to government agencies, law enforcement, critical infrastructure, or any third-party production system — without permission is illegal in most jurisdictions (in Indonesia, this falls under UU ITE) and may constitute a criminal offense elsewhere.
• The author(s) of this repository:
  • Take no responsibility for misuse of this code.
  • Do not condone using this PoC to disrupt, degrade, or deny service to any system without authorization.
  • Provide this code as-is, with no warranty of any kind.
• If you are a vendor, agency, or system operator who found this repository because your system was tested: see Section 6 — Disclosure Timeline for how this was reported and to whom.

By downloading, cloning, or executing any code in this repository, you agree that you are solely responsible for ensuring you have proper authorization, and that you accept full legal responsibility for your use of it.

4. Recon Method

CVE-2026-49975 only applies to a target that satisfies both criteria in Section 1 — reachable over HTTP/2 and running an in-range, vulnerable mod_http2 version (2.4.17 ≤ version ≤ 2.4.67, default config). A plain curl -vkI against the target's HTTPS port is enough to check both — no scanner or extra flags needed:

What to look for in the output:

• ALPN: server accepted h2 — the server negotiated HTTP/2 for this connection. This is the precondition for CVE-2026-49975, since the bug lives in mod_http2; a server that never accepted h2 here isn't a candidate.
• The Server response header (visible once the HEAD response headers print, further down in -v output) — this is what confirms or rules out the actual Apache/mod_http2 version against the vulnerable range in Section 1. ALPN acceptance alone does not confirm the version — that still needs the Server header or an equivalent banner check.

Nothing beyond this is used for recon in this repo — no active exploitation traffic, no vulnerability scanners, no port sweeps.

5. Requirements

• Runtime: Go 1.26+ (module: cve202649975)
• Dependencies: golang.org/x/net v0.59.0 (resolved automatically via go build)
• Network access: direct TCP reachability to the authorized target on the specified port (default 443, TLS/h2 by default; --no-ssl for plaintext h2c)
• Optional: proxychains4 — if the binary is launched under proxychains4, it detects the LD_PRELOAD wrapper, reads the same proxychains4.conf, and routes its own connections through that SOCKS5 proxy (remote DNS resolution) — useful when an engagement's scope requires testing from a specific egress path
• Permissions: written authorization / engagement letter for the target being tested

6. Disclosure Timeline

Public timeline of CVE-2026-49975 itself: reported to Apache 2026-05-26; fix landed upstream in mod_h2 2026-05-27; merged into the httpd 2.4.x branch 2026-06-02; Apache HTTP Server 2.4.68 released 2026-06-08.

7. Usage

Only run this against a target you are explicitly authorized to test. There is no built-in duration limit or safe-mode — you are responsible for how long it runs and at what concurrency.

Build:

Run:

Example, minimal authorized lab test:

Behavior to expect:

• Prints a pre-flight summary (target, mode, connection/stream counts, estimated server-side memory) before sending anything.
• Holds streams open with 1-byte WINDOW_UPDATE drips and periodic pings; auto-reconnects and repeats if the server closes the connection.
• Only stops when you send Ctrl+C / SIGTERM — plan your test window accordingly and monitor the target's memory in real time.
• Recommended: validate against a staging/lab environment first with low --streams/--headers before any authorized production test, and have a rollback/restart plan for the target service ready regardless.

7a. RAM Pressure Estimate

Rough server-side memory formula for this tool's two modes (Apache mod_http2 only — see Section 1 for how nginx/classic map to amplification ratio):

Scale threads/streams/headers up and the number grows linearly — this is why an authorized lab test should start low (see Section 7) before any production-scope run.

7b. Technical Details

This documents the mechanism this specific PoC implements against Apache mod_http2 — it does not extend to other server implementations, which are out of scope for this repository (see Section 2).

HPACK dynamic-table seed (incremental indexing, adds entry at index 62):

Indexed reference to that entry (1 byte each, repeated --headers times):

HTTP/2 frame sequence per connection:

Wire cost is small and mostly fixed per stream (a handful of bytes for the seed + 1 byte per reference); the server-side allocation is what grows disproportionately — that gap is the vulnerability.

7c. Example Output

Output from an authorized lab run, classic mode, 20 connections × 30 streams/conn, 5000 HPACK refs/stream, routed through proxychains:

Each connection independently reports its own local RAM contribution as it opens streams (~572 MB per connection at these settings); the pre-flight Est. server RAM figure is the aggregate across all 20 connections (~11.4 GB) once every connection is fully open and holding.

domain.com above is a placeholder — replace with your actual authorized target when documenting your own run, and redact it if the engagement is confidential.

8. Remediation

• Apache HTTP Server: upgrade to httpd 2.4.68 or later (this is the release containing the fix).
• If immediate patching isn't possible:
  • Set LimitRequestFields conservatively and monitor header-merge behavior.
  • Consider disabling HTTP/2 on the affected listener until patched.
  • Front the service with a reverse proxy/WAF that enforces a hard header-count cap.
• Re-test after remediation to confirm the hold-and-release behavior no longer causes sustained memory growth.

9. Credits / Attribution

Original vulnerability discovery & disclosure to Apache (no relation to this repository or its author):

• Quang Luong, Calif.IO, in collaboration with OpenAI Codex
• Reported to the Apache HTTP Server Project 2026-05-26; official credit line published in the 2.4.68 changelog

This repository (Go reimplementation, written and tested after the public fix landed):

• Author: naheeju
• Independent PoC built from the public vulnerability description and patch diff, for verification/educational purposes against authorized targets. Not affiliated with the original discovery, Calif.IO, or the Apache Security Team.

Questions, corrections, or responsible-disclosure-adjacent concerns about this specific PoC: open an issue on this repository.

License: MIT (this repository's code only — see LICENSE). Does not extend to, or imply endorsement by, the original discoverers or the Apache Software Foundation.