Loading story…
Researchers publicly disclosed HTTP/2 Bomb, a remote denial-of-service technique that abuses standard HTTP/2 behavior to rapidly exhaust memory on major web servers and proxies, including nginx, Apache HTTP Server, Microsoft IIS, Envoy, and Cloudflare Pingora. The attack combines HPACK header-compression amplification with a Slowloris-style flow-control stall, letting a low-bandwidth client trigger disproportionate server-side allocations and keep that memory pinned by advertising a zero-byte window. Reports said a single machine on a 100 Mbps connection could make vulnerable services inaccessible within seconds, with testing showing Apache httpd and Envoy consuming roughly 32 GB of RAM in about 10 to 20 seconds under default HTTP/2 configurations.
Public disclosures and proof-of-concept code indicated the amplification largely comes from per-header bookkeeping rather than oversized decoded header values, allowing common decoded-size limits to be bypassed. Apache tracked its exposure as CVE-2026-49975 and released a fix in mod_http2 2.0.41, while nginx addressed the issue in 1.29.8; advisories initially said IIS, Envoy, and Pingora lacked patches, though later disclosures showed Envoy assigned CVE-2026-47774 and published an advisory. Researchers estimated more than 880,000 internet-exposed HTTP/2 systems could be affected and recommended upgrading where fixes exist, or otherwise disabling HTTP/2, enforcing strict header-count limits, and monitoring for abnormal memory growth.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
Subsequent coverage emphasized that HTTP/2 Bomb stems from standard HTTP/2 and HPACK behavior rather than a single implementation flaw, and reiterated that nginx and Apache had fixes while patches for IIS, Envoy, and Pingora were still unavailable. The reporting also highlighted the role of AI-assisted analysis in combining previously known techniques.
Reporting on the disclosure said Cloudflare disputed that Pingora required a patch, arguing its architecture and DDoS protections already mitigated the attack. The same report said Microsoft was investigating mitigations for IIS.
One source states nginx was notified in April about the HTTP/2 Bomb issue and added a fix in nginx version 1.29.8. Multiple references identify 1.29.8 as the patched version for nginx.
News and security outlets reported technical details of HTTP/2 Bomb, including that a single client could pin roughly 32 GB of memory on Apache httpd and Envoy in about 20 seconds and that more than 880,000 internet-exposed systems might be vulnerable. These reports also noted that IIS, Envoy, and Pingora lacked patches at that time.
Envoy published a security advisory describing an HTTP/2 downstream request processing vulnerability that can cause excessive memory consumption and OOM termination. The advisory said the attack could be further amplified by HTTP/2 flow-control stalling, linking it to the broader HTTP/2 Bomb technique.
A companion GitHub repository for the HTTP/2 Bomb research was published with self-contained proof-of-concept directories for Envoy, Apache httpd, nginx, Microsoft IIS, and Cloudflare Pingora. The repository said the exploits were verified and functional and documented amplification ratios across targets.
Researchers publicly disclosed HTTP/2 Bomb, a denial-of-service technique that combines HPACK compression abuse with HTTP/2 flow-control stalling to exhaust memory on major web servers under default configurations. The disclosure named nginx, Apache httpd, Microsoft IIS, Envoy, and Cloudflare Pingora as affected implementations.
A source says Apache was notified on May 27 and released a fix the same day for the HTTP/2 Bomb issue, tracked as CVE-2026-49975 in mod_http2 v2.0.41. Other references corroborate that Apache assigned the CVE and made the fix available.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
15 references tracked. Mallory keeps watching after this page renders.
bugflation.com
Open sourcemy.f5.com
Open sourcesocprime.com
Open sourcexakep.ru
Open sourceseclists.org
Open sourceblog.calif.io
Open sourcegithub.com
Open sourceseclists.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A newly disclosed denial-of-service vulnerability dubbed **HTTP/2 Bomb** (`CVE-2026-49975`) can let unauthenticated attackers crash vulnerable servers by abusing HTTP/2 header compression and flow-control behavior to amplify small requests into large in-memory allocations. Researchers said the flaw affects widely deployed infrastructure including **nginx**, **Apache httpd**, **Microsoft IIS**, **Envoy**, and **Cloudflare Pingora**, with early Internet scans identifying more than **880,000** potentially exposed websites. Security firms reported reconnaissance activity in the wild, and sectors with large numbers of Internet-facing systems—especially **telecommunications, IT, and healthcare**—were flagged as particularly exposed. A public proof-of-concept is now available for **Apache HTTP Server**, where affected versions **2.4.17 through 2.4.67** can be forced into sustained memory exhaustion through crafted HTTP/2 cookie headers and a zero-window flow-control technique that prevents resources from being released. Apache fixed the issue in **2.4.68**, while other vendors have rolled out patches or mitigations on uneven timelines, including earlier fixes from nginx and Apache, a next-day patch from Envoy, a later mitigation from Microsoft, and no patch yet reported for Cloudflare at the time of coverage. Defenders are being urged to **upgrade immediately**, consider temporarily disabling HTTP/2 where feasible, and watch for abnormal memory growth and other signs of attempted DoS activity.
Jun 29, 2026
A newly disclosed denial-of-service flaw in multiple HTTP/2 server implementations allows remote, unauthenticated attackers to exhaust memory and crash services by abusing normal flow-control behavior. By stalling outbound data transmission—such as by manipulating `SETTINGS_INITIAL_WINDOW_SIZE` or withholding `WINDOW_UPDATE` frames—an attacker can cause vulnerable servers to keep generating and buffering full responses, leading to out-of-memory conditions, swap thrashing, worker-thread exhaustion, service freezes, or kernel OOM kills. CERT/CC is tracking the issue after it was reported by the Okta Red Team, and the coordinated disclosures include `CVE-2026-44909`, `CVE-2026-59173`, and `CVE-2026-59762`. Affected vendors named in advisories include Apache Traffic Server, Citrix, F5 Networks, Meta, Red Hat, SUSE, and Yahoo. Apache Traffic Server users were advised to upgrade to versions `9.1.14` or `10.1.3`, while F5 published guidance for BIG-IP and other vendors issued product-specific fixes or mitigations. Recommended defenses include stricter memory limits, limiting concurrent HTTP/2 streams, terminating stalled connections, and improving timeout and backpressure handling. No public exploitation has been confirmed, but the low complexity of the attack has prompted calls for rapid patching and configuration hardening.
Jul 24, 2026
CERT/CC disclosed **VU#885548**, a denial-of-service condition in some HTTP/2 server implementations that can be triggered remotely without authentication by abusing stalled flow-control behavior. An attacker can advertise settings such as `SETTINGS_INITIAL_WINDOW_SIZE = 0` or stop sending `WINDOW_UPDATE` frames, forcing servers to buffer large response bodies in memory across many concurrent streams. The resulting impact can include memory exhaustion, swap thrashing, worker or connection exhaustion, service instability, and in severe cases a full crash. Okta Red Team was credited with reporting the issue, and the advisory linked the problem to **`CVE-2026-59762`**, **`CVE-2026-59173`**, and **`CVE-2026-44909`**. F5 said **`CVE-2026-59762`** affects **BIG-IP** and related **BIG-IP Next** products when an HTTP/2 profile is configured on a virtual server, allowing crafted requests to drive up memory use in the **TMM** process until performance degrades or TMM restarts; the company rated the flaw **CVSS 7.5** under v3.1 and **8.7** under v4.0 and urged customers to install patched releases. Apache also confirmed **`CVE-2026-59173`** in **Apache Traffic Server** versions **9.0.0 through 9.2.13** and **10.0.0 through 10.1.2**, recommending upgrades to **9.2.14+** or **10.1.3+**. CERT noted that several vendors have already issued fixes, while some products including GNU wget, Go, HAProxy, ISC BIND, lighttpd, and nghttp2 were listed as not affected.
Jul 17, 2026