This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Critical HTTP/2 Bomb vulnerability in web servers
a newly published vulnerability named HTTP/2 Bomb poses a critical risk to the availability of most of the commonly used web servers. The vulnerability is officially registered under the Apache project, but in the default HTTP/2 configuration it also affects NGINX, Microsoft IIS, Envoy and Cloudflare Pingora servers [1]. Status of web server fixes: nginx [1] - 1.29.8 and later; a temporary mitigation is to disable HTTP/2 completely using http2 off;. Apache httpd [1] - mod_http2 v2.0.41; available in httpd trunk and in standalone mod_http2 releases [2], not yet available in the 2.4.x branch; a temporary mitigation is to disable HTTP/2 using Protocols http/1.1. Envoy [1][3] - 1.35.11, 1.36.7, 1.37.3, 1.38.1 (validation of effectiveness is in progress [1]). Microsoft IIS (including Microsoft Server 2025), Cloudflare Pingora [1] - currently not available.
An unauthenticated remote attacker can, by sending specially crafted sequences of HTTP/2 frames (for header compression and flow control), completely exhaust the system memory (RAM) of the target web server and carry out a DoS attack. This mechanism is based on a combination of the “HPACK Indexed Reference Bomb” and “HTTP/2 Window Stall” techniques [1][4]. The mechanisms of this attack are known from previously published vulnerabilities - abuse of the HPACK compression mechanism [5][6] and Slowloris-type resource exhaustion [7][8]. Detailed information about the vulnerability can be found at [1], a PoC (per server) at [9]. If a fixed version is not currently available or cannot be deployed immediately, the risk can generally be temporarily mitigated by disabling HTTP/2, strictly capping the number of headers (including individual cookie parts) regardless of their total size, limiting the lifetime of stalled streams, or setting memory limits at the process level (cgroups, ulimit) so that the operating system terminates the overloaded process in time (OOM-kill) [1].
CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
More information:
- CVE-2026-49975 at cve.org, NVD
- CWE-400: Uncontrolled Resource Consumption at cwe.mitre.org
The vulnerability was publicly disclosed 27. 5. 2026.
Links
- [1] https://blog.calif.io/p/codex-discovered-a-hidden-http2-bomb
- [2] https://github.com/icing/mod_h2/releases
- [3] https://github.com/envoyproxy/envoy/security/advisories/GHSA-22m2-hvr2-xqc8
- [4] https://www.suse.com/security/cve/CVE-2026-49975.html
- [5] https://nvd.nist.gov/vuln/detail/CVE-2016-6581
- [6] https://nvd.nist.gov/vuln/detail/CVE-2025-53020
- [7] https://nvd.nist.gov/vuln/detail/CVE-2016-8740
- [8] https://nvd.nist.gov/vuln/detail/cve-2016-1546
- [9] https://github.com/califio/publications/tree/main/MADBugs/http2-bomb
By CESNET, z.s.p.o. Michaela Ručková on 4. 6. 2026.