New 'HTTP/2 Bomb' DoS attack crashes web servers in under a minute
HTTP/2 Bomb DoS attack crashes web servers in seconds via HPACK amplification and flow-control stalling.
Researchers at Calif discovered HTTP/2 Bomb, a new DoS attack combining HPACK compression amplification with HTTP/2 flow-control stalling to exhaust server memory within seconds. A single machine on a 100 Mbps connection can consume 32GB of RAM and crash vulnerable servers like Apache httpd, Envoy, NGINX, IIS, and Cloudflare Pingora. Patches have been released for NGINX (1.29.8) and Apache httpd (CVE-2026-49975), but no fixes are yet available for IIS, Envoy, or Pingora.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft?
Get an email when a new story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe HTTP/2 Bomb attack demonstrates how protocol implementation vulnerabilities can be weaponized to cause devastating denial-of-service conditions with minimal resources. By exploiting HPACK compression amplification and HTTP/2 flow-control mechanisms, attackers can force servers to consume massive amounts of memory (32GB) within seconds using only a 100 Mbps connection. This affects major web servers including Apache, NGINX, IIS, Envoy, and Cloudflare Pingora, highlighting the critical importance of timely patching and proactive vulnerability management. The attack's effectiveness against multiple platforms underscores how protocol-level flaws can have widespread impact across the internet infrastructure.
What helps against this
How we list vendors
- Automated patch management
Known holes get closed in days, not months.
- Next-generation firewall and intrusion prevention
Malicious traffic is blocked at the network edge and between zones.
- Web application firewall and DDoS protection
Websites and APIs stay up, and common web attacks are filtered before they reach them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-49975