[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fgaOfZh7e25FEVA7G9kOp_I0QASDdTpWmp4WS24jXBAw":3},{"article":4,"iocs":47,"watch_terms":61,"solutions":62,"lesson":128},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"c133cb15-d9bd-4139-a219-73b512ce5829","New HTTP\u002F2 Bomb Vulnerability Allows Remote DoS on NGINX, Apache, IIS, Envoy & Cloudflare","new-http-2-bomb-vulnerability-allows-remote-dos-on-nginx-apache-iis-envoy-cloudf-aea883","Cybersecurity researchers have discovered a remote denial-of-service exploit that affects major web servers, including NGINX, Apache HTTPD, Microsoft IIS, Envoy, and Cloudflare Pingora. The vulnerability has been codenamed HTTP\u002F2 Bomb by Calif. \"The vulnerable behavior exists in each server's default HTTP\u002F2 configuration,\" the company said, adding it was discovered by OpenAI Codex by chaining","Researchers discovered HTTP\u002F2 Bomb, a remote denial-of-service vulnerability affecting major web servers (NGINX, Apache HTTPD, Microsoft IIS, Envoy, Cloudflare Pingora) that exploits HPACK header compression combined with flow-control stalling. A single attacker on a home connection can exhaust 32GB of server memory in seconds by sending crafted HTTP\u002F2 requests with nearly-empty headers that trigger excessive per-entry bookkeeping allocations. Patches are available for NGINX (v1.29.8+) and Apache HTTPD (mod_http2 v2.0.41), while Microsoft IIS, Envoy, and Cloudflare Pingora remain unpatched.","HTTP\u002F2 Bomb vulnerability enables remote DoS on NGINX, Apache, IIS, Envoy, and Cloudflare","https:\u002F\u002Fthehackernews.com\u002F2026\u002F06\u002Fnew-http2-bomb-vulnerability-allows.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhP07q0cgsa0a9VyTU6oPpxqvoZ5Gg2spx-ClmUIzn9LjYzDfuKNxnLXNuXMexiMB8GjKewhk7CnAL5HXgpCL_wq5eaU8VK2mTxxcKJHAZ9eLBskg516sBn4SV5XHWOuZIozDzBD_0MUCAMcVpGyqOEWITNKi2mQFxFLl9gqg_3UxPlwmXCkRfm2JERftyN\u002Fs1600\u002Fhttp2.gif","2026-06-03T08:33:35+00:00","2026-06-03T10:00:22.569948+00:00",9,[17,20,22,24,26,28],{"name":18,"type":19},"NGINX","product",{"name":21,"type":19},"Apache HTTPD",{"name":23,"type":19},"Microsoft IIS",{"name":25,"type":19},"Envoy",{"name":27,"type":19},"Cloudflare Pingora",{"name":29,"type":30},"HTTP\u002F2 HPACK","technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,42],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[48,52,55,58],{"type":49,"value":50,"context":51},"cve","CVE-2016-6581","HPACK Bomb vulnerability, foundational technique referenced in HTTP\u002F2 Bomb",{"type":49,"value":53,"context":54},"CVE-2025-53020","Memory exhaustion vulnerability in Apache httpd HTTP\u002F2 implementation",{"type":49,"value":56,"context":57},"CVE-2016-8740","DoS flaw in Apache HTTP Server via crafted CONTINUATION frames",{"type":49,"value":59,"context":60},"CVE-2016-1546","Worker-thread starvation DoS in HTTP\u002F2 connection",[18,21,23],{"controls":63,"vendors":122},[64,93],{"slug":65,"name":66,"problem":67,"products":68},"patch-management","Automated patch management","Known holes get closed in days, not months.",[69,77,85],{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":94,"name":95,"problem":96,"products":97},"waf-ddos","Web application firewall and DDoS protection","Websites and APIs stay up, and common web attacks are filtered before they reach them.",[98,106,114],{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"f5","F5","\u002Fvendor-logos\u002Ff5.png","web-app-and-api-protection","F5 Web App and API Protection","https:\u002F\u002Fwww.f5.com\u002Fsolutions\u002Fweb-app-and-api-protection","Web application firewall, API security, bot management and DDoS mitigation, as a service or self-managed.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"imperva","Imperva","\u002Fvendor-logos\u002Fimperva.png","imperva-cloud-waf","Imperva Cloud WAF","https:\u002F\u002Fwww.imperva.com\u002Fproducts\u002Fweb-application-firewall-waf\u002F","Cloud web application firewall with DDoS and bot protection.",{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-waf","Cloudflare WAF and DDoS protection","https:\u002F\u002Fwww.cloudflare.com\u002Fproducts\u002Fwaf\u002F","Web application firewall and unmetered DDoS mitigation for websites and APIs.",[123,126],{"slug":115,"name":116,"logo_path":117,"roles":124},[125],"affected",{"slug":70,"name":71,"logo_path":72,"roles":127},[125],{"slug":129,"title":130,"body":131,"framework_refs":132,"framework_notes":139},"http2-bomb-dos-vulnerability-exposes-web-server-infrastructure","HTTP\u002F2 Bomb DoS Vulnerability Exposes Web Server Infrastructure","The HTTP\u002F2 Bomb vulnerability demonstrates how protocol implementation flaws can be weaponized for devastating denial-of-service attacks against critical web infrastructure. Attackers exploit HPACK header compression combined with flow-control mechanisms to force servers to allocate excessive memory (32GB in seconds) through crafted requests with minimal bandwidth requirements. This attack is particularly dangerous because it allows low-resourced attackers to overwhelm high-capacity servers, and many affected systems remain unpatched. Organizations must prioritize vulnerability management and emergency patching procedures to protect against such protocol-level exploits.",[133,134,135,136,137,138],"CIS Control 7.1","CIS Control 12.2","NIST SI-2","NIST SI-4","NIST IR-4","OWASP ASVS V14.2",{}]