[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fSCNnpd8_5OAidT6SX6HEGq9YlZId4xzdfytk_miqNMY":3},{"article":4,"iocs":42,"watch_terms":47,"solutions":48,"lesson":144},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"c9ec016a-cc39-4a2c-a07b-fda711ae93bd","New 'HTTP\u002F2 Bomb' DoS attack crashes web servers in under a minute","new-http-2-bomb-dos-attack-crashes-web-servers-in-under-a-minute-f1e95b","A new denial-of-service (DoS) attack dubbed HTTP\u002F2 Bomb can be launched from a single machine to take down web servers within seconds. [...]","Researchers at Calif discovered HTTP\u002F2 Bomb, a new DoS attack combining HPACK compression amplification with HTTP\u002F2 flow-control stalling to exhaust server memory within seconds. A single machine on a 100 Mbps connection can consume 32GB of RAM and crash vulnerable servers like Apache httpd, Envoy, NGINX, IIS, and Cloudflare Pingora. Patches have been released for NGINX (1.29.8) and Apache httpd (CVE-2026-49975), but no fixes are yet available for IIS, Envoy, or Pingora.","HTTP\u002F2 Bomb DoS attack crashes web servers in seconds via HPACK amplification and flow-control stalling.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fnew-http-2-bomb-dos-attack-crashes-web-servers-in-under-a-minute\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2024\u002F06\u002F27\u002Fcluster-bomb.jpg","2026-06-03T19:08:19+00:00","2026-06-03T20:00:24.424689+00:00",9,[17,20,22,24,26,28],{"name":18,"type":19},"Apache Software Foundation","vendor",{"name":21,"type":19},"NGINX",{"name":23,"type":19},"Microsoft",{"name":25,"type":19},"Cloudflare",{"name":27,"type":19},"Envoy",{"name":29,"type":30},"HTTP\u002F2 Bomb","product","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",[43],{"type":44,"value":45,"context":46},"cve","CVE-2026-49975","HTTP\u002F2 Bomb DoS vulnerability in Apache httpd mod_http2",[23,18,21],{"controls":49,"vendors":136},[50,79,108],{"slug":51,"name":52,"problem":53,"products":54},"patch-management","Automated patch management","Known holes get closed in days, not months.",[55,63,71],{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":59,"product_name":60,"url":61,"description":62},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":80,"name":81,"problem":82,"products":83},"firewall","Next-generation firewall and intrusion prevention","Malicious traffic is blocked at the network edge and between zones.",[84,92,100],{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"clavister","Clavister","\u002Fvendor-logos\u002Fclavister.png","clavister-netwall","Clavister NetWall","https:\u002F\u002Fwww.clavister.com\u002Fproducts\u002Fclavister-netwall\u002F","Next-generation firewalls developed in Sweden.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","quantum-firewall","Quantum Force firewalls","https:\u002F\u002Fwww.checkpoint.com\u002Fquantum\u002Fnext-generation-firewall\u002F","Next-generation firewalls with threat prevention.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"fortinet","Fortinet","\u002Fvendor-logos\u002Ffortinet.png","fortigate","FortiGate","https:\u002F\u002Fwww.fortinet.com\u002Fproducts\u002Fnext-generation-firewall","Next-generation firewalls with intrusion prevention and SD-WAN.",{"slug":109,"name":110,"problem":111,"products":112},"waf-ddos","Web application firewall and DDoS protection","Websites and APIs stay up, and common web attacks are filtered before they reach them.",[113,120,128],{"vendor_slug":114,"vendor_name":25,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-waf","Cloudflare WAF and DDoS protection","https:\u002F\u002Fwww.cloudflare.com\u002Fproducts\u002Fwaf\u002F","Web application firewall and unmetered DDoS mitigation for websites and APIs.",{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","app-and-api-protector","Akamai App & API Protector","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fapp-and-api-protector","Web application firewall, bot and DDoS protection for websites and APIs.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"imperva","Imperva","\u002Fvendor-logos\u002Fimperva.png","imperva-cloud-waf","Imperva Cloud WAF","https:\u002F\u002Fwww.imperva.com\u002Fproducts\u002Fweb-application-firewall-waf\u002F","Cloud web application firewall with DDoS and bot protection.",[137,140],{"slug":114,"name":25,"logo_path":115,"roles":138},[139],"affected",{"slug":141,"name":23,"logo_path":142,"roles":143},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png",[139],{"slug":145,"title":146,"body":147,"framework_refs":148,"framework_notes":154},"http2-bomb-dos-attack-exploits-protocol-implementation-flaws","HTTP\u002F2 Bomb DoS Attack Exploits Protocol Implementation Flaws","The HTTP\u002F2 Bomb attack demonstrates how protocol implementation vulnerabilities can be weaponized to cause devastating denial-of-service conditions with minimal resources. By exploiting HPACK compression amplification and HTTP\u002F2 flow-control mechanisms, attackers can force servers to consume massive amounts of memory (32GB) within seconds using only a 100 Mbps connection. This affects major web servers including Apache, NGINX, IIS, Envoy, and Cloudflare Pingora, highlighting the critical importance of timely patching and proactive vulnerability management. The attack's effectiveness against multiple platforms underscores how protocol-level flaws can have widespread impact across the internet infrastructure.",[149,150,151,152,153],"CIS Control 7","NIST SP 800-40","CIS Control 12","NIST SP 800-61","CIS Control 1",{}]