Loading vulnerability…
CVE-2026-47774 is a high-severity denial-of-service vulnerability in Envoy downstream HTTP/2 request processing. Envoy did not fully include buffered Cookie header bytes and cookie-fragment counts in request-header-size validation. In parallel, the oghttp2/quiche HTTP/2 implementation enforced HPACK header-block limits against encoded bytes without a corresponding total decoded-header-size limit. An attacker can use HPACK dynamic-table references and split Cookie header fields to keep the wire representation small while inducing substantially larger decoded cookie-header allocations. HTTP/2 flow-control stalling can retain those allocations for longer, exacerbating memory consumption. The issue affects Envoy releases before 1.35.11, 1.36.7, 1.37.3, and 1.38.1.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
Repository contains a Python proof-of-concept exploit for an HTTP/2 denial-of-service issue described as CVE-2026-49975, plus a companion defense-probing script and a local HTTP/2 test server. The main exploit file is http2_bomb.py, which manually builds HTTP/2 traffic using hyperframe and hpack rather than a higher-level HTTP client. It opens a TCP/TLS connection to a user-supplied host and port, negotiates ALPN 'h2' when TLS is enabled, sends the HTTP/2 connection preface and SETTINGS, and then performs the attack by abusing HPACK compression and HTTP/2 flow control. The exploit’s core capability is to insert small headers into the HPACK dynamic table and then send many indexed references across multiple streams, creating asymmetric server-side memory/bookkeeping cost. It also sets INITIAL_WINDOW_SIZE to 0 to inhibit response delivery and can periodically send WINDOW_UPDATE frames to keep the connection alive, effectively pinning allocations. Optional cookie fragmentation is included to try to bypass header-count limits. probe_defense.py is not the exploit itself; it is a detection/probing utility that connects to a target HTTP/2 service and evaluates whether mitigations appear present based on protocol behavior. test_server.py is a local vulnerable-style HTTP/2 server used for validation and demonstration; it listens with TLS, accepts HTTP/2 connections, decodes headers, and logs large header counts to simulate the vulnerable processing path. Repository structure is small and focused: 3 Python code files, 1 README, 1 requirements file, and .gitignore. Dependencies are h2/hpack/hyperframe. This is a real exploit repository, not just documentation, and its practical outcome is application-layer remote DoS rather than code execution. No hardcoded victim infrastructure is embedded; the operator supplies the target host and port at runtime.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.