New HTTP/2 Bomb Vulnerability Allows Remote DoS on NGINX, Apache, IIS, Envoy & Cloudflare
HTTP/2 Bomb vulnerability enables remote DoS on NGINX, Apache, IIS, Envoy, and Cloudflare
Researchers discovered HTTP/2 Bomb, a remote denial-of-service vulnerability affecting major web servers (NGINX, Apache HTTPD, Microsoft IIS, Envoy, Cloudflare Pingora) that exploits HPACK header compression combined with flow-control stalling. A single attacker on a home connection can exhaust 32GB of server memory in seconds by sending crafted HTTP/2 requests with nearly-empty headers that trigger excessive per-entry bookkeeping allocations. Patches are available for NGINX (v1.29.8+) and Apache HTTPD (mod_http2 v2.0.41), while Microsoft IIS, Envoy, and Cloudflare Pingora remain unpatched.
AI summary of the linked source. Not reviewed by an editor. How this works
Run NGINX?
Get an email when a new story names NGINX, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe HTTP/2 Bomb vulnerability demonstrates how protocol implementation flaws can be weaponized for devastating denial-of-service attacks against critical web infrastructure. Attackers exploit HPACK header compression combined with flow-control mechanisms to force servers to allocate excessive memory (32GB in seconds) through crafted requests with minimal bandwidth requirements. This attack is particularly dangerous because it allows low-resourced attackers to overwhelm high-capacity servers, and many affected systems remain unpatched. Organizations must prioritize vulnerability management and emergency patching procedures to protect against such protocol-level exploits.
What helps against this
How we list vendors
- Automated patch management
Known holes get closed in days, not months.
- Web application firewall and DDoS protection
Websites and APIs stay up, and common web attacks are filtered before they reach them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2016-6581
- cve — CVE-2025-53020
- cve — CVE-2016-8740
- cve — CVE-2016-1546