wlor0623/http2-bomb-detectorHTTP/2 Bomb (CVE-2026-49975) non-destructive vulnerability detector for Nginx / Apache httpd. Zero-dependency Python.
HTTP/2 Bomb (CVE-2026-49975) Non-destructive vulnerability detection tool — for Nginx / Apache httpd
CVE-2026-49975 is a widespread remote denial-of-service vulnerability in the HTTP/2 protocol layer, discovered by security researcher Quang Luong. This vulnerability exploits a combined design flaw in HPACK header compression and flow control mechanisms, allowing an attacker to exhaust 32GB of server memory within 10-20 seconds without authentication.
| Server | Affected Versions | Amplification Ratio | Fix Status |
|---|---|---|---|
| Apache httpd | 2.4.17 – 2.4.67 (mod_http2 < 2.0.41) | ~4,000:1 | ✅ Fixed |
| Nginx | < 1.29.8 | ~70:1 | ✅ Fixed |
| Envoy | ≤ 1.37.2 | ~5,700:1 | ❌ Not Fixed |
| Microsoft IIS | including Windows Server 2025 | ~68:1 | ❌ Not Fixed |
| Cloudflare Pingora | ≤ 0.8.0 | ~62:1 | ❌ Not Fixed |
This tool is based on a real PoC and uses two detection modes:
Detects HPACK index reference bomb: inserts dynamic table entry ("a", ""), then sends index references. Each reference is 1 byte on the wire → 59 bytes of server memory (3B pool copy + 56B ngx_table_elt_t). Attack parameters refs=32000, detection uses only refs=3.
Detects Cookie crumb merge bomb: exploits the Cookie merging mechanism in mod_http2 (apr_table_setn concatenates duplicate cookies with "; "), and the merged cookie is not counted towards LimitRequestFields. Attack parameters refs=4091 (~4000:1 amplification), detection uses only refs=3.
ENHANCE_YOUR_CALM → 🛡️ ProtectedRST_STREAM rejection → 🛡️ ProtectedGOAWAY → 🛡️ ProtectedZero dependencies, only uses Python standard library (ssl, socket, struct).
git clone https://github.com/adminlove520/http2-bomb-detector.git
cd http2-bomb-detector
Requires Python 3.7+.
# Auto-detect (Nginx + Apache both modes)
python http2_bomb_detector.py --host example.com
# Specify mode
python http2_bomb_detector.py --host example.com --mode nginx
python http2_bomb_detector.py --host example.com --mode httpd
# Specify port
python http2_bomb_detector.py --host example.com --port 8443
# Only output vulnerability info, do not send probe packets
python http2_bomb_detector.py --host example.com --no-probe
# JSON format output
python http2_bomb_detector.py --host example.com --json
# Read target list from file
python http2_bomb_detector.py -f targets.txt
# Output report
python http2_bomb_detector.py -f targets.txt -o report.txt
targets.txt format (one per line, lines starting with # are comments):
# Web server list
example.com
https://example.org:8443
192.168.1.100
[INFO] Connecting to example.com:443 ...
[OK] HTTP/2 connection established
[INFO] --- NGINX Mode Detection ---
[INFO] Attack vector: HPACK index reference bomb: dynamic table entry ('a','') × 32000 references
[INFO] Fixed version: 1.29.8 | Amplification ratio: ~70:1
[INFO] Sending probe packet (refs=3, non-destructive)...
[WARN] ⚠️ Server silently accepted probe packet — potentially vulnerable!
[INFO] --- HTTPD Mode Detection ---
[INFO] Attack vector: Cookie crumb merge bomb: empty cookie × 4091 references
[INFO] Fixed version: mod_http2 2.0.41 / httpd 2.4.68 | Amplification ratio: ~4000:1
[INFO] Sending probe packet (refs=3, non-destructive)...
[OK] Server RST_STREAM rejected probe stream — protected
==================================================
🛡️ NGINX: potentially_vulnerable
⚠️ HTTPD: protected
This tool is only for authorized security testing. Using this tool to test unauthorized targets may violate the law. Users must assume all legal responsibilities.
MIT