A newly disclosed “HTTP/2 Bomb” attack is raising serious concerns across the web infrastructure ecosystem, enabling remote denial-of-service (DoS) conditions against widely deployed servers including nginx, Apache httpd, Microsoft IIS, Envoy, and Cloudflare Pingora.
Overview of the HTTP/2 Bomb Attack
Security researcher Quang Luong, working with the Codex team, uncovered a novel exploitation technique that chains two long-known weaknesses in HTTP/2: HPACK header compression abuse and flow-control stalling.
While each technique has existed for years, their combined use creates a powerful memory exhaustion vector that impacts the default configurations of major web servers.
The attack allows a low-bandwidth client to consume massive amounts of server memory within seconds, as per reported by Calif.
In testing, a single machine with a 100 Mbps connection was able to push Apache httpd and Envoy servers to allocate up to 32 GB of memory in under 20 seconds, effectively rendering them unresponsive.
The exploit hinges on two mechanisms:
- HPACK Indexed Reference Bomb: HTTP/2 uses HPACK (RFC 7541) to compress headers via indexed references. Attackers insert a small header into the dynamic table, then repeatedly reference it using single-byte indices. Each reference forces the server to allocate memory for a full header entry, resulting in amplification ratios of ~5,700:1 in Envoy and ~4,000:1 in Apache.
- HTTP/2 Flow Control Abuse: The attacker advertises a zero-byte flow-control window, preventing the server from completing responses. Periodic 1-byte WINDOW_UPDATE frames keep the connection alive while all allocated memory remains pinned, creating a Slowloris-style resource exhaustion condition.
A critical bypass involves splitting Cookie headers into multiple “crumbs,” which some servers fail to count against header limits, enabling unbounded header expansion without triggering safeguards.
Affected Systems and Exposure
The vulnerability affects default HTTP/2 implementations in:
- nginx (before 1.29.8)
- Apache httpd (mod_http2 < 2.0.41)
- Microsoft IIS (Windows Server 2025)
- Envoy proxy
- Cloudflare Pingora
Internet-wide scans indicate over 880,000 exposed HTTP/2 endpoints running these technologies, though many are partially shielded behind CDNs.
This new attack builds on a decade of related work, including the original HPACK Bomb (CVE-2016-6581), HTTP/2 Slowloris-style issues such as CVE-2016-8740 and CVE-2016-1546, and later Apache-specific HPACK amplification tracked as CVE-2025-53020.
The newly assigned CVE-2026-49975 covers an Apache httpd fix that finally makes Cookie headers count against LimitRequestFields, directly addressing one of the key bypasses exploited by HTTP/2 Bomb.
Mitigations are emerging but uneven across vendors. For nginx, administrators should upgrade to 1.29.8 or later, which introduces a max_headers directive with a default value of 1000; deployments unable to patch immediately are advised to disable HTTP/2 with the http2 off directive.
Apache users can pull the fix from mod_http2 v2.0.41, available as a standalone module and in trunk, though not yet in a stable 2.4.x release.
As a temporary measure, Apache deployments can disable HTTP/2 via Protocol http/1.1 and consider tightening LimitRequestFieldSize to reduce the per-stream impact, while understanding it is only a partial mitigation.
At the time of disclosure, Microsoft IIS, Envoy, and Pingora had no public patches, so organizations are advised to disable HTTP/2 where possible or to place the services behind a reverse proxy or CDN that enforces hard limits on header count per request, including cookie crumbs.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
