PoC Archive PoC Archive

tag

Mod_http2

  • CVE-2026-49975 network HIGH EPSS 28%

    Apache HTTP Server HTTP/2 HPACK Cookie-Merging Memory Bomb (CVE-2026-49975)

    CVE-2026-49975 is a denial-of-service vulnerability in Apache HTTP Server's HTTP/2 request handling. A small HPACK-encoded HTTP/2 header block can reference the HPACK dynamic-table entry for the cookie header many times (up to the request field limit), which…

    Unverified 2026-07-05
  • CVE-2026-23918 web CRITICAL EPSS 50%

    Apache httpd mod_http2 Double-Free Pre-Auth RCE - CVE-2026-23918

    CVE-2026-23918 is a pre-authentication double-free vulnerability in Apache httpd's modhttp2 stream cleanup path. Under affected configurations, a remote attacker can trigger memory corruption over HTTP/2 before authentication. The upstream PoC demonstrates…

    Patched 2026-05-17