Loading vulnerability…
CVE-2026-49160 is an uncontrolled resource-consumption vulnerability in the Windows HTTP protocol stack, HTTP.sys, during HTTP/2 request processing. Crafted HTTP/2 requests can cause excessive resource consumption by the HTTP server. The issue is publicly disclosed and is also referred to as HTTP/2 Bomb.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
Small PoC repository with two files: a README describing claimed HTTP.sys issues (CVE-2026-49160 and CVE-2026-47291) and one Python exploit/probe script, http2_bomb.py. The Python script is the main artifact. It uses Python's ssl/socket libraries plus the hyper-h2 library to establish a TLS connection, require ALPN negotiation of HTTP/2 ('h2'), initiate an HTTP/2 session, and send a single GET request containing the 4 required pseudo-headers plus a user-controlled number of additional regular headers (default 20, named x-fooooooo-XXXX). It then reads and prints HTTP/2 events such as response headers, data, stream end, stream reset, or connection termination. The exploit capability is therefore a network/web-layer malformed-or-stress request generator aimed at exercising vulnerable HTTP/2 header handling in HTTP.sys, potentially for denial-of-service testing or vulnerability triggering. There is no shellcode, command execution, persistence, or follow-on payload. The README also includes a separate illustrative Python snippet that slowly sends a very large number of HTTP/1.1 headers to hello.lab over TLS and claims this can increment an internal counter toward overflow for CVE-2026-47291, but that snippet is documentation only and not present as a runnable repository file. Overall, this is a proof-of-concept network exploit repository focused on triggering or probing HTTP.sys request-header parsing behavior over HTTPS/HTTP2 rather than achieving post-exploitation control.
This repository is a small proof-of-concept for CVE-2026-49160 targeting Microsoft HTTP.sys. It contains only two files: a minimal README identifying the issue as an HTTP.sys denial-of-service PoC, and a single Python script, http2_bomb.py, which is the operational entry point. The script uses Python's socket and ssl modules plus the hyper-h2 library to create a TLS connection, require ALPN negotiation of HTTP/2 ('h2'), and send one crafted HTTP/2 GET request with a configurable number of extra headers. The exploit logic is straightforward: connect to a user-specified host and port, optionally disable certificate validation for lab use, build the HTTP/2 pseudo-headers and many synthetic x-fooooooo-* headers, transmit them on a single stream, then monitor the target's behavior. It prints response headers if any are returned and also detects stream resets, HTTP/2 connection termination, timeouts, or abrupt TLS closure. There is no shellcode, command execution, persistence, or post-exploitation capability; the purpose is to trigger or validate a denial-of-service condition over the network against an HTTP/2-enabled HTTPS endpoint backed by HTTP.sys. The repository is not part of a larger exploit framework and appears to be a focused standalone PoC.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
39 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A zero-day vulnerability in Microsoft's HTTP/2 and HTTP/3 HPACK compression handling that can trigger a compression bomb and excessive resource consumption.
A publicly disclosed, remote unauthenticated denial-of-service vulnerability in Windows HTTP.sys caused by uncontrolled resource consumption during HTTP/2 processing.
High-severity zero-day denial-of-service vulnerability in HTTP.sys caused by how the service processes incoming HTTP/2 requests, allowing remote unauthenticated attackers to exhaust system resources and cause service unavailability.
A zero-day denial-of-service vulnerability in Windows HTTP.sys that can crash vulnerable servers via a crafted HTTP/2 request.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.