Loading story…
A newly disclosed denial-of-service technique dubbed HTTP/2 Bomb can crash or severely disrupt exposed HTTP/2 web servers by combining HPACK compression amplification with Slowloris-style resource retention through HTTP/2 flow control. Public reporting says a single attacker with a 100 Mbps connection can drive servers to consume tens of gigabytes of RAM within seconds, with testing exhausting 32 GB on Envoy in about 10 seconds and 64 GB on Microsoft IIS in roughly 45 seconds.
The issue affects default HTTP/2 deployments across NGINX, Apache HTTP Server with mod_http2, Microsoft IIS, Envoy Proxy, and Cloudflare Pingora, and is tracked as CVE-2026-49975 for NGINX and Apache. Patches have been released for NGINX and Apache, but no fixes were available in the cited advisories for IIS, Envoy, or Pingora; defenders were urged to upgrade where possible, disable HTTP/2 if necessary, place exposed services behind a WAF, reverse proxy, or CDN, and monitor for abnormal memory spikes.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
By June 4, 2026, NGINX and Apache had released patches for the HTTP/2 Bomb vulnerability tracked as CVE-2026-49975. The issue affected HTTP/2-enabled deployments, while IIS, Envoy, and Pingora still had no fixes available at that time.
A new denial-of-service technique dubbed “HTTP/2 Bomb” was publicly disclosed, showing how HTTP/2 servers can be forced to rapidly exhaust memory by combining compression amplification with resource-retention behavior. Public proof-of-concept code was already available at disclosure.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
cert.gov.az
Open sourcecert.pa
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers publicly disclosed **HTTP/2 Bomb**, a remote denial-of-service technique that abuses standard HTTP/2 behavior to rapidly exhaust memory on major web servers and proxies, including **nginx, Apache HTTP Server, Microsoft IIS, Envoy, and Cloudflare Pingora**. The attack combines **HPACK header-compression amplification** with a **Slowloris-style flow-control stall**, letting a low-bandwidth client trigger disproportionate server-side allocations and keep that memory pinned by advertising a zero-byte window. Reports said a single machine on a 100 Mbps connection could make vulnerable services inaccessible within seconds, with testing showing **Apache httpd** and **Envoy** consuming roughly **32 GB of RAM** in about **10 to 20 seconds** under default HTTP/2 configurations. Public disclosures and proof-of-concept code indicated the amplification largely comes from per-header bookkeeping rather than oversized decoded header values, allowing common decoded-size limits to be bypassed. **Apache** tracked its exposure as **`CVE-2026-49975`** and released a fix in **`mod_http2 2.0.41`**, while **nginx** addressed the issue in **`1.29.8`**; advisories initially said **IIS, Envoy, and Pingora** lacked patches, though later disclosures showed **Envoy** assigned **`CVE-2026-47774`** and published an advisory. Researchers estimated more than **880,000** internet-exposed HTTP/2 systems could be affected and recommended upgrading where fixes exist, or otherwise disabling HTTP/2, enforcing strict header-count limits, and monitoring for abnormal memory growth.
Jul 20, 2026
A newly disclosed denial-of-service vulnerability dubbed **HTTP/2 Bomb** (`CVE-2026-49975`) can let unauthenticated attackers crash vulnerable servers by abusing HTTP/2 header compression and flow-control behavior to amplify small requests into large in-memory allocations. Researchers said the flaw affects widely deployed infrastructure including **nginx**, **Apache httpd**, **Microsoft IIS**, **Envoy**, and **Cloudflare Pingora**, with early Internet scans identifying more than **880,000** potentially exposed websites. Security firms reported reconnaissance activity in the wild, and sectors with large numbers of Internet-facing systems—especially **telecommunications, IT, and healthcare**—were flagged as particularly exposed. A public proof-of-concept is now available for **Apache HTTP Server**, where affected versions **2.4.17 through 2.4.67** can be forced into sustained memory exhaustion through crafted HTTP/2 cookie headers and a zero-window flow-control technique that prevents resources from being released. Apache fixed the issue in **2.4.68**, while other vendors have rolled out patches or mitigations on uneven timelines, including earlier fixes from nginx and Apache, a next-day patch from Envoy, a later mitigation from Microsoft, and no patch yet reported for Cloudflare at the time of coverage. Defenders are being urged to **upgrade immediately**, consider temporarily disabling HTTP/2 where feasible, and watch for abnormal memory growth and other signs of attempted DoS activity.
Jun 29, 2026
A newly disclosed denial-of-service flaw in multiple HTTP/2 server implementations allows remote, unauthenticated attackers to exhaust memory and crash services by abusing normal flow-control behavior. By stalling outbound data transmission—such as by manipulating `SETTINGS_INITIAL_WINDOW_SIZE` or withholding `WINDOW_UPDATE` frames—an attacker can cause vulnerable servers to keep generating and buffering full responses, leading to out-of-memory conditions, swap thrashing, worker-thread exhaustion, service freezes, or kernel OOM kills. CERT/CC is tracking the issue after it was reported by the Okta Red Team, and the coordinated disclosures include `CVE-2026-44909`, `CVE-2026-59173`, and `CVE-2026-59762`. Affected vendors named in advisories include Apache Traffic Server, Citrix, F5 Networks, Meta, Red Hat, SUSE, and Yahoo. Apache Traffic Server users were advised to upgrade to versions `9.1.14` or `10.1.3`, while F5 published guidance for BIG-IP and other vendors issued product-specific fixes or mitigations. Recommended defenses include stricter memory limits, limiting concurrent HTTP/2 streams, terminating stalled connections, and improving timeout and backpressure handling. No public exploitation has been confirmed, but the low complexity of the attack has prompted calls for rapid patching and configuration hardening.
Jul 24, 2026