[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fWOBeUhrVoT2VtJdouGxCMatq5l4N_WLuPYFB8UTc_Pc":3},{"article":4,"iocs":42,"watch_terms":59,"solutions":60,"lesson":155},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"62f29f15-a8a1-4817-b270-721287653a2c","‘HTTP\u002F2 Bomb’ Exploit Knocks Web Servers Offline in Seconds","http-2-bomb-exploit-knocks-web-servers-offline-in-seconds-b6f3a2","The default HTTP\u002F2 configuration of major web servers is vulnerable to an attack chain combining a compression bomb and a Slowloris-style hold. The post ‘HTTP\u002F2 Bomb’ Exploit Knocks Web Servers Offline in Seconds appeared first on SecurityWeek.","Security researchers have discovered HTTP\u002F2 Bomb, a denial-of-service exploit that chains together HPACK compression bombs with Slowloris-style memory exhaustion attacks to rapidly take down major web servers. The attack affects over 880,000 websites running default configurations of NGINX, Apache HTTPD, Microsoft IIS, Envoy, or Cloudflare Pingora and can be launched from a home computer on a 100 Mbps connection. While the underlying techniques are not new (some dating back a decade), the novel combination was identified using OpenAI's Codex and demonstrates how AI can detect previously overlooked attack chains.","HTTP\u002F2 Bomb exploit chains compression and Slowloris attacks to knock web servers offline in seconds.","https:\u002F\u002Fwww.securityweek.com\u002Fhttp-2-bomb-exploit-knocks-web-servers-offline-in-seconds\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2025\u002F08\u002FHTTP-request-smuggling-internet-traffic.jpg","2026-06-03T10:52:08+00:00","2026-06-03T12:00:22.121836+00:00",9,[17,20,22,24,26,29],{"name":18,"type":19},"Apache","vendor",{"name":21,"type":19},"NGINX",{"name":23,"type":19},"Microsoft",{"name":25,"type":19},"Cloudflare",{"name":27,"type":28},"Apache HTTPD","product",{"name":30,"type":28},"Microsoft IIS","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",[43,47,50,53,56],{"type":44,"value":45,"context":46},"cve","CVE-2016-6581","HPACK Bomb compression-layer attack on HTTP\u002F2 header compression",{"type":44,"value":48,"context":49},"CVE-2025-53020","Apache HTTP Server vulnerability related to HPACK Bomb, resolved in version 2.4.64",{"type":44,"value":51,"context":52},"CVE-2016-8740","Apache HTTPD HTTP\u002F2 Slowloris-type DoS via Continuation frames",{"type":44,"value":54,"context":55},"CVE-2016-1546","Apache HTTPD Slow Read vulnerability leading to DoS via modified flow-control windows",{"type":44,"value":57,"context":58},"CVE-2026-49975","Apache vulnerability resolved in late May patches related to HTTP\u002F2 Bomb",[23,18,21],{"controls":61,"vendors":145},[62,91,116],{"slug":63,"name":64,"problem":65,"products":66},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[67,75,83],{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":92,"name":93,"problem":94,"products":95},"patch-management","Automated patch management","Known holes get closed in days, not months.",[96,100,108],{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":92,"product_name":97,"url":98,"description":99},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":117,"name":118,"problem":119,"products":120},"waf-ddos","Web application firewall and DDoS protection","Websites and APIs stay up, and common web attacks are filtered before they reach them.",[121,129,137],{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"f5","F5","\u002Fvendor-logos\u002Ff5.png","web-app-and-api-protection","F5 Web App and API Protection","https:\u002F\u002Fwww.f5.com\u002Fsolutions\u002Fweb-app-and-api-protection","Web application firewall, API security, bot management and DDoS mitigation, as a service or self-managed.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"imperva","Imperva","\u002Fvendor-logos\u002Fimperva.png","imperva-cloud-waf","Imperva Cloud WAF","https:\u002F\u002Fwww.imperva.com\u002Fproducts\u002Fweb-application-firewall-waf\u002F","Cloud web application firewall with DDoS and bot protection.",{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":141,"product_name":142,"url":143,"description":144},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","app-and-api-protector","Akamai App & API Protector","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fapp-and-api-protector","Web application firewall, bot and DDoS protection for websites and APIs.",[146,151],{"slug":147,"name":25,"logo_path":148,"roles":149},"cloudflare","\u002Fvendor-logos\u002Fcloudflare.png",[150],"affected",{"slug":152,"name":23,"logo_path":153,"roles":154},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png",[150],{"slug":156,"title":157,"body":158,"framework_refs":159,"framework_notes":165},"default-web-server-configurations-enable-devastating-dos-attacks","Default Web Server Configurations Enable Devastating DoS Attacks","The HTTP\u002F2 Bomb exploit demonstrates how default configurations on major web servers can create severe vulnerabilities when combined in unexpected ways. While the individual attack techniques (HPACK compression bombs and Slowloris attacks) have been known for years, their novel combination creates a devastating denial-of-service capability that affects over 880,000 websites. This highlights the critical importance of hardening web server configurations beyond default settings and maintaining awareness of how seemingly separate vulnerabilities can be chained together. The fact that AI tools helped identify this attack chain also shows the evolving threat landscape where automated discovery of complex exploit combinations is becoming more accessible to attackers.",[160,161,162,163,164],"CIS Control 7","CIS Control 12","NIST SP 800-53 SC-5","NIST SP 800-53 CM-6","OWASP ASVS V14",{}]