{"id":1135,"date":"2026-06-03T09:50:14","date_gmt":"2026-06-03T09:50:14","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=1135"},"modified":"2026-06-03T09:50:14","modified_gmt":"2026-06-03T09:50:14","slug":"new-http-2-bomb-vulnerability-allows-remote-dos-on-nginx-apache-iis-envoy-cloudflare","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=1135","title":{"rendered":"New HTTP\/2 Bomb Vulnerability Allows Remote DoS on NGINX, Apache, IIS, Envoy & Cloudflare"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Jun 03, 2026<\/span><\/span>Vulnerability \/ Server Security<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

Cybersecurity researchers have discovered a remote denial-of-service exploit that affects major web servers, including NGINX, Apache HTTPD, Microsoft IIS, Envoy, and Cloudflare Pingora.<\/p>\n

The vulnerability has been codenamed HTTP\/2 Bomb<\/a><\/b> by Calif.<\/p>\n

\u00abThe vulnerable behavior exists in each server’s default HTTP\/2 configuration,\u00bb the company said, adding it was discovered by OpenAI Codex by chaining together two known techniques: a compression bomb and a Slowloris-style hold.<\/p>\n

\u00abThe bomb targets HPACK, HTTP\/2’s header compression scheme: one byte on the wire becomes one full header allocation on the server, repeated thousands of times per request,\u00bb Calif added. \u00abThe hold is a zero-byte flow-control window that keeps the server from ever freeing any of it.\u00bb<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

HPACK<\/a> is a dedicated header compression algorithm for HTTP\/2 used for compressing request and response metadata using Huffman encoding that results in an average reduction of 30% in header size. It’s also designed to be resilient to attacks like CRIME<\/a> (short for \u00abCompression Ratio Info-leak Made Easy\u00bb) that can leak authentication cookies from compressed headers.<\/p>\n

Slowloris, on the other hand, is a type of denial-of-service (DoS) attack that allows a threat actor to overwhelm a targeted server by opening and maintaining many simultaneous HTTP connections between the attacker and the target. It is an application-layer attack.<\/p>\n

HTTP\/2 Bomb is inspired by various known approaches like HPACK Bomb (aka CVE-2016-6581<\/a>), which was first disclosed in 2016, as well as CVE-2025-53020<\/a>, a memory exhaustion vulnerability in Apache httpd’s HTTP\/2 implementation, and two DoS flaws in Apache HTTP Server via crafted CONTINUATION frames (CVE-2016-8740<\/a>) and worker-thread starvation (CVE-2016-1546<\/a>) in an HTTP\/2 connection.<\/p>\n

\u00abWhat’s new here is where the amplification comes from,\u00bb Calif said. \u00abThe classic bomb stuffs a large value into the table and references it repeatedly, so servers learned to cap the total decoded header size. Our variant goes the other way: the header is nearly empty, and the amplification comes from the per-entry bookkeeping the server allocates around it. The decoded-size limit never fires because there’s almost nothing to decode.\u00bb<\/p>\n

In a hypothetical attack scenario, a home computer on a 100Mbps connection has the potential to render a vulnerable server inaccessible within seconds. What’s more, a single client can consume and hold 32GB of server memory against Apache HTTPD and Envoy in about 20 seconds.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

To counter the vulnerability, it’s advised to apply the following mitigations –<\/p>\n