HTTP/2 Bomb DoS Can Exhaust Web Server Memory in Seconds
Summary
Researchers say HTTP/2 Bomb combines HPACK amplification with flow-control stalling to exhaust web-server memory. nginx and Apache have fixes; the article says IIS, Envoy, and Pingora had no patches at publication.
Key points
- The technique combines HPACK compression amplification with HTTP/2 flow-control stalling to retain allocated memory.
- Researchers demonstrated memory exhaustion from a single client; Envoy and Apache httpd each used 32 GB in under 20 seconds.
- Tests also exhausted 32 GB on nginx in about 45 seconds and 64 GB on IIS in about 45 seconds.
- The researchers say small header values can bypass defenses that limit total decoded header size.
- The article reports fixes in nginx 1.29.8 and Apache httpd mod_http2 2.0.41; the Apache issue is identified as CVE-2026-49975.
- At publication, the article reported no patches for IIS, Envoy, or Pingora and recommended disabling HTTP/2 where feasible or enforcing hard header-count limits with a proxy or firewall.
Article Details
- Vulnerability Types
- Denial of service through memory exhaustion
- HPACK compression amplification combined with HTTP/2 flow-control stalling
- Affected Versions
- Envoy 1.37.2
- Apache httpd 2.4.67
- nginx 1.29.7
- IIS on Windows Server 2025
- Exploitation Status
- reported
- Exploit Availability
- public_poc
- Patch Status
- partial
- Workarounds
- Disable HTTP/2 where feasible.
- Place a proxy or firewall in front that enforces hard header-count limits.
MITRE ATT&CK
CVE
People
Products
Apache HTTP ServerResearchers found it can exhaust huge amounts of memory on NGINX, Apache HTTP Server, Microsoft IIS, Envoy, and Cloudflare Pingora, with some fixes already available for nginx and Apache.Cloudflare PingoraResearchers found it can exhaust huge amounts of memory on NGINX, Apache HTTP Server, Microsoft IIS, Envoy, and Cloudflare Pingora, with some fixes already available for nginx and Apache.EnvoyResearchers found it can exhaust huge amounts of memory on NGINX, Apache HTTP Server, Microsoft IIS, Envoy, and Cloudflare Pingora, with some fixes already available for nginx and Apache.Microsoft IISResearchers found it can exhaust huge amounts of memory on NGINX, Apache HTTP Server, Microsoft IIS, Envoy, and Cloudflare Pingora, with some fixes already available for nginx and Apache.NGINXResearchers found it can exhaust huge amounts of memory on NGINX, Apache HTTP Server, Microsoft IIS, Envoy, and Cloudflare Pingora, with some fixes already available for nginx and Apache.