CVE-2026-49975-HTTP-2-Bomb

A triage (not exploitation) tool to identify attack surfaces exposed to CVE-2026-49975 — "HTTP/2 Bomb".

⚠️ This script does not send attack payloads. It only makes normal HTTP requests and analyzes response headers to flag hosts that warrant manual version/patch verification.

About CVE-2026-49975

Disclosed on June 3, 2026, the "HTTP/2 Bomb" is an unauthenticated remote DoS that combines an HPACK compression bomb with a Slowloris-style hold to exhaust server memory. It affects default HTTP/2 configurations of nginx, Apache httpd, Microsoft IIS, Envoy, and Cloudflare Pingora.

As the advisories note, simply asking "does the host support HTTP/2?" is too broad — the real exposure depends on the implementation and version in use. That's why this script identifies the server software and classifies the result into attention levels, without claiming exploitation.

Features

• 🏴 ASCII banner and full help (-h)
• 🧵 Multithreading via FIFO semaphore (concurrency controlled by -t)
• 🔒 Atomic output across threads (no interleaved lines, via flock)
• 📄 Input by single host, file (-f), or stdin (-f -)
• 🔍 Software/version detection via the Server header
• 🎯 Reliable HTTP/2 detection via curl's %{http_version}
• 📊 CSV export (-o)
• 🎨 Colored output (can be disabled with --no-color)

Requirements

• bash 4+
• curl (with HTTP/2 support)
• flock (optional, recommended — util-linux)

Installation

chmod +x detect_http2_bomb.sh

Usage

# Single host
./detect_http2_bomb.sh example.com

# Host list with 30 threads and CSV output
./detect_http2_bomb.sh -f hosts.txt -t 30 -o results.csv

# Reading hosts from stdin
cat hosts.txt | ./detect_http2_bomb.sh -f -

Options

Verdicts

CSV format

host,server,verdict,status
example.com,"nginx",FLAG,"HTTP/2 active + nginx"

Fixed-version reference

This script's version check is informational only. Always confirm against the official vendor advisory.

Legal notice

Use only against authorized targets — your own infrastructure, bug bounty programs, or contracted pentests. Use against systems without authorization may be illegal. The author is not responsible for misuse.

Author: Renzi