{"vulnerability": "CVE-2026-49975", "sightings": [{"uuid": "72b1745c-9606-4c13-b4b6-52b3bbc8f4ae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49975", "type": "seen", "source": "https://bsky.app/profile/hmier.bsky.social/post/3mnf3sod7zs24", "content": "HTTP/2 BOMB CVE-2026-49975\n\nan assymmetric Denial of Service originated from the RFC\n\nan attacker can send a compresed request that when uncompressed on the server side consumes 32GB memory.\napache, nginx patch now.\nIIS, others still no patch.\nblog.calif.io/p/codex-disc...", "creation_timestamp": "2026-06-03T12:19:44.116342Z"}, {"uuid": "ccdef18e-9a6e-4c41-8e3f-a30ec2b0189b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49975", "type": "seen", "source": "https://t.me/GithubRedTeam/87196", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a Proof-of-Concept-POC---CVE-2026-49975-HTTP-2-Bomb-\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a fevar54\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-03 20:34:56\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nEste repositorio contiene un Proof of Concept (POC) para CVE-2026-49975, tambi\u00e9n conocida como HTTP/2 Bomb, una vulnerabilidad de denegaci\u00f3n de servicio (DoS) remoto que afecta a la mayor\u00eda de los servidores web principales en su configuraci\u00f3n HTTP/2 predeterminada, incluyendo:\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-06-03T21:00:04.000000Z"}, {"uuid": "c0048cd3-c2cb-4c1c-87df-ada916c73ae9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49975", "type": "seen", "source": "https://bsky.app/profile/buyoh.bsky.social/post/3mngas7khi22e", "content": "[CVE-2026-49975] \u30ea\u30e2\u30fc\u30c8\u30b5\u30fc\u30d3\u30b9\u62d2\u5426\uff08DoS\uff09\u306e\u8106\u5f31\u6027 HTTP/2 Bomb \u306b\u3064\u3044\u3066\npub.hpc-technologies.co.jp/security/htt...", "creation_timestamp": "2026-06-03T23:21:37.207003Z"}, {"uuid": "d3e4bcf0-c9b7-47fc-b9b8-3911d946430a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49975", "type": "seen", "source": "https://bsky.app/profile/slackers.it/post/3mngqgfdjtb23", "content": "6/19\n\nhttps://seclists.org/oss-sec/2026/q2/790\n    https://www.cve.org/CVERecord?id=CVE-2026-49975\n  (* Security fix *)\nn/mosh-1.4.0-x86_64-21.txz:  Rebuilt.\n  Recompiled against abseil-cpp-20260526.0.\nn/net-tools-20181103_0eebece-x86_64-4.txz:  Rebuilt.", "creation_timestamp": "2026-06-04T04:01:19.936525Z"}, {"uuid": "07d1e576-ac3f-4335-85ae-27437ea26db7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49975", "type": "seen", "source": "https://bsky.app/profile/skip2networks.bsky.social/post/3mngvr7h6ly25", "content": "HTTP/2 Bomb is a remote denial-of-service attack affecting major web servers including nginx, Apache, IIS, Envoy, and Pingora. At this time we do not believe our network is vulnerable. Read more: https://www.skip2.net/blog/security/CVE-2026-49975", "creation_timestamp": "2026-06-04T05:36:52.382839Z"}, {"uuid": "6c0ec0b7-0535-4acf-aa7b-191fd091991a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49975", "type": "seen", "source": "https://bsky.app/profile/securestep9.bsky.social/post/3mngz6bl5an2s", "content": "#DDoS: New 'HTTP/2 Bomb' DoS attack crashes major web servers in under a minute. Impacted servers include #NGINX, #Apache HTTP Server, Microsoft #IIS, Envoy, and Cloudflare Pingora. This vulnerability was discovered by Codex AI agent. CVE-2026-49975:\n\ud83d\udc47", "creation_timestamp": "2026-06-04T06:37:51.425349Z"}, {"uuid": "4f041818-94d1-4ee6-9f20-dc26a42373ca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-49975", "type": "seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=1898", "content": "", "creation_timestamp": "2026-06-03T21:00:00.000000Z"}, {"uuid": "71b9f311-bfde-483a-949d-e9bdbe507f29", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49975", "type": "seen", "source": "https://t.me/GithubRedTeam/87238", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-49975-POC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a mrx-arafat\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-04 06:23:07\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nHTTP/2 Bomb PoC \u2014 CVE-2026-49975 (HPACK indexed reference bomb + flow-control stall)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-06-04T07:00:04.000000Z"}]}