Loading vulnerability…
CVE-2026-47774 is a high-severity denial-of-service vulnerability in Envoy’s downstream HTTP/2 request processing. In affected versions prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, Envoy does not fully account for cookie header bytes during request header size validation, creating a gap in enforcement of intended header size protections. The issue is compounded by HPACK handling in oghttp2/quiche, where header block limits are enforced on encoded bytes without an equivalent bound on total decoded header size. An unauthenticated remote client can exploit this mismatch by sending compact HTTP/2 header representations that expand into very large decoded cookie/header allocations in Envoy memory. Under sustained abuse, this can drive excessive per-stream memory consumption and trigger out-of-memory termination of the Envoy process. The issue is part of the broader HTTP/2 Bomb class of resource-exhaustion attacks.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
Repository contains a Python proof-of-concept exploit for an HTTP/2 denial-of-service issue described as CVE-2026-49975, plus a companion defense-probing script and a local HTTP/2 test server. The main exploit file is http2_bomb.py, which manually builds HTTP/2 traffic using hyperframe and hpack rather than a higher-level HTTP client. It opens a TCP/TLS connection to a user-supplied host and port, negotiates ALPN 'h2' when TLS is enabled, sends the HTTP/2 connection preface and SETTINGS, and then performs the attack by abusing HPACK compression and HTTP/2 flow control. The exploit’s core capability is to insert small headers into the HPACK dynamic table and then send many indexed references across multiple streams, creating asymmetric server-side memory/bookkeeping cost. It also sets INITIAL_WINDOW_SIZE to 0 to inhibit response delivery and can periodically send WINDOW_UPDATE frames to keep the connection alive, effectively pinning allocations. Optional cookie fragmentation is included to try to bypass header-count limits. probe_defense.py is not the exploit itself; it is a detection/probing utility that connects to a target HTTP/2 service and evaluates whether mitigations appear present based on protocol behavior. test_server.py is a local vulnerable-style HTTP/2 server used for validation and demonstration; it listens with TLS, accepts HTTP/2 connections, decodes headers, and logs large header counts to simulate the vulnerable processing path. Repository structure is small and focused: 3 Python code files, 1 README, 1 requirements file, and .gitignore. Dependencies are h2/hpack/hyperframe. This is a real exploit repository, not just documentation, and its practical outcome is application-layer remote DoS rather than code execution. No hardcoded victim infrastructure is embedded; the operator supplies the target host and port at runtime.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.