Http2 — PoC Archivehttps://poc.intelseclab.com/tags/http2/Latest proof-of-concept entries.Hugoen-usSun, 05 Jul 2026 00:00:00 +0000Windows HTTP.sys Header-Count-Triggered Kernel Memory Corruption / BSOD (CVE-2026-49160)https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-49160-http-sys-http2-bomb-dos/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-49160-http-sys-http2-bomb-dos/High severity — binary · CVE-2026-49160. Status: PoC. Affects: Windows HTTP.sys kernel-mode driver (Windows 10 build 26100 confirmed in crash logs). Tags: windows, http.sys, kernel, http2, dos, bsod, memory-corruption, integer-overflow.binaryHighwindowshttp.syskernelhttp2dosbsodmemory-corruptioninteger-overflowNGINX HTTP/2 Frame Injection via Vulnerable Upstream Proxying (CVE-2026-42926)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-42926-nginx-http2-frame-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-42926-nginx-http2-frame-injection/High severity — web · CVE-2026-42926. Status: PoC. Affects: NGINX (HTTP/2 upstream proxying). Tags: nginx, http2, frame-injection, reverse-proxy, request-smuggling, docker-lab.webHighnginxhttp2frame-injectionreverse-proxyrequest-smugglingdocker-labgRPC-Go RBAC Authorization Bypass via Missing Leading Slash in `:path` (CVE-2026-33186)https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-33186-grpc-go-rbac-authz-bypass/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-33186-grpc-go-rbac-authz-bypass/High severity — network · CVE-2026-33186 (GHSA-p77j-4mvh-x3m3). Status: PoC. Affects: google.golang.org/grpc (grpc-go) authz package (SDK-level RBAC). Tags: grpc, grpc-go, rbac, authorization-bypass, http2, path-normalization, golang, access-control.networkHighgrpcgrpc-gorbacauthorization-bypasshttp2path-normalizationgolangaccess-controlApache HTTP Server HTTP/2 HPACK Cookie-Merging Memory Bomb (CVE-2026-49975)https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-49975-apache-http2-cookie-bomb-dos/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-49975-apache-http2-cookie-bomb-dos/High severity — network · CVE-2026-49975. Status: PoC. Affects: Apache HTTP Server (mod_http2). Tags: apache, httpd, http2, hpack, mod_http2, cookie-header, memory-exhaustion, denial-of-service, flow-control.networkHighapachehttpdhttp2hpackmod_http2cookie-headermemory-exhaustiondenial-of-serviceflow-control