nghttpx HTTP/2 Upgrade Queue Poisoning PoC Execution or Anomalous Activity

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•5

This rule detects the execution of tools associated with HTTP/2 upgrade queue poisoning proof-of-concept (PoC) code or anomalous process-level interactions involving nghttpx. It tracks specific command-line strings, file operations, and unauthorized spawned sub-processes originating from nghttpx, which could indicate attempts to exploit request smuggling vulnerabilities in HTTP/2 implementations.