Loading vulnerability…
CVE-2026-49160 is a high-severity denial-of-service vulnerability in the Windows HTTP Protocol Stack (HTTP.sys) caused by uncontrolled resource consumption while processing HTTP/2 requests. The issue is associated with abuse of HTTP/2 header compression handling, described in reporting as involving HPACK and, in some references, analogous HTTP/3 header-processing behavior. A remote attacker can send specially crafted HTTP/2 requests with excessive or compression-abusive headers that force HTTP.sys to consume excessive memory and CPU while decompressing and processing request headers. This resource-exhaustion condition can rapidly destabilize or crash affected services that rely on HTTP.sys, including IIS and other Windows services using the kernel HTTP stack. The issue has been publicly referred to as “HTTP/2 Bomb.”
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
Small PoC repository with two files: a README describing claimed HTTP.sys issues (CVE-2026-49160 and CVE-2026-47291) and one Python exploit/probe script, http2_bomb.py. The Python script is the main artifact. It uses Python's ssl/socket libraries plus the hyper-h2 library to establish a TLS connection, require ALPN negotiation of HTTP/2 ('h2'), initiate an HTTP/2 session, and send a single GET request containing the 4 required pseudo-headers plus a user-controlled number of additional regular headers (default 20, named x-fooooooo-XXXX). It then reads and prints HTTP/2 events such as response headers, data, stream end, stream reset, or connection termination. The exploit capability is therefore a network/web-layer malformed-or-stress request generator aimed at exercising vulnerable HTTP/2 header handling in HTTP.sys, potentially for denial-of-service testing or vulnerability triggering. There is no shellcode, command execution, persistence, or follow-on payload. The README also includes a separate illustrative Python snippet that slowly sends a very large number of HTTP/1.1 headers to hello.lab over TLS and claims this can increment an internal counter toward overflow for CVE-2026-47291, but that snippet is documentation only and not present as a runnable repository file. Overall, this is a proof-of-concept network exploit repository focused on triggering or probing HTTP.sys request-header parsing behavior over HTTPS/HTTP2 rather than achieving post-exploitation control.
This repository is a small proof-of-concept for CVE-2026-49160 targeting Microsoft HTTP.sys. It contains only two files: a minimal README identifying the issue as an HTTP.sys denial-of-service PoC, and a single Python script, http2_bomb.py, which is the operational entry point. The script uses Python's socket and ssl modules plus the hyper-h2 library to create a TLS connection, require ALPN negotiation of HTTP/2 ('h2'), and send one crafted HTTP/2 GET request with a configurable number of extra headers. The exploit logic is straightforward: connect to a user-specified host and port, optionally disable certificate validation for lab use, build the HTTP/2 pseudo-headers and many synthetic x-fooooooo-* headers, transmit them on a single stream, then monitor the target's behavior. It prints response headers if any are returned and also detects stream resets, HTTP/2 connection termination, timeouts, or abrupt TLS closure. There is no shellcode, command execution, persistence, or post-exploitation capability; the purpose is to trigger or validate a denial-of-service condition over the network against an HTTP/2-enabled HTTPS endpoint backed by HTTP.sys. The repository is not part of a larger exploit framework and appears to be a focused standalone PoC.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
36 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A zero-day vulnerability in Microsoft's HTTP/2 and HTTP/3 HPACK compression handling that can trigger a compression bomb and excessive resource consumption.
High-severity zero-day denial-of-service vulnerability in HTTP.sys caused by how the service processes incoming HTTP/2 requests, allowing remote unauthenticated attackers to exhaust system resources and cause service unavailability.
A zero-day denial-of-service vulnerability in Windows HTTP.sys that can crash vulnerable servers via a crafted HTTP/2 request.
Уязвимость/атака, связанная со стандартной конфигурацией HTTP/2 и затрагивающая популярные веб-серверы и прокси.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.