New 'HTTP/2 Bomb' DoS attack crashes web servers in under a minute
Researchers say a new HTTP/2 DoS method can exhaust server memory in seconds from a single machine. Patches exist for nginx and Apache httpd, but not yet for IIS, Envoy, or Pingora.
Intelligence analysis by GPT-5.4 Mini
The article describes HTTP/2 Bomb, a denial-of-service attack that combines HPACK compression amplification with HTTP/2 flow-control stalling. On default configurations, it can push major web servers into severe memory exhaustion very quickly.
It is like sending a tiny package that tricks a warehouse into reserving huge shelves forever. The server keeps saving space for the attacker’s request until it runs out of room and stops working.
Analysis
What the attack does
Researchers at Calif say HTTP/2 Bomb is a new denial-of-service technique that can be launched from a single machine and can take down vulnerable web servers in seconds. It combines two known HTTP/2 behaviors: HPACK header compression amplification and Slowloris-style resource retention through flow-control stalling.
The first half abuses HPACK by inserting a header into the dynamic table and then referencing it repeatedly with a tiny indexed form. That means the attacker can send a very small amount of data while forcing the server to do much larger internal bookkeeping and memory allocation. The article says Envoy and Apache httpd showed especially high amplification ratios, reaching 5,700:1 and 4,000:1.
The second half keeps that memory from being released. By advertising a zero-byte flow-control window, the attacker prevents the request from fully finishing. The server keeps sending small WINDOW_UPDATE frames to avoid timing out, but the allocated memory remains tied up and continues to grow.
Impact reported by the researchers
BleepingComputer reports that Calif tested the technique against major web servers and saw very fast memory exhaustion: Envoy 1.37.2 hit 32 GB in about 10 seconds, Apache httpd 2.4.67 in about 18 seconds, nginx 1.29.7 in about 45 seconds, and IIS on Windows Server 2025 reached 64 GB in about 45 seconds.
The researchers say the attack bypasses some existing header-size defenses because the header values themselves are tiny; the damage comes from internal per-header allocations and bookkeeping, not from large payloads.
Mitigations and fixes
The article says nginx 1.29.8 fixes the issue with a new max_headers directive, and Apache httpd mod_http2 2.0.41 addresses it under CVE-2026-49975. At the time of writing, there is no patch yet for IIS, Envoy, or Pingora. For those platforms, the article recommends disabling HTTP/2 where possible and putting a proxy or firewall in front that enforces hard header-count limits.
Key points
- Researchers say HTTP/2 Bomb can crash vulnerable web servers from a single machine in seconds.
- The attack combines HPACK compression amplification with HTTP/2 flow-control stalling.
- Envoy, Apache httpd, nginx, IIS, and Cloudflare Pingora are mentioned as affected on default configurations.
- nginx and Apache httpd already have fixes, but IIS, Envoy, and Pingora do not yet.
- The recommended defenses are patching, disabling HTTP/2 where feasible, and enforcing strict header-count limits in front of the server.
Some major platforms already have fixes or mitigation paths, which gives operators a way to reduce exposure quickly. The article also notes that CDNs, reverse proxies, WAFs, and custom header limits can make some deployments harder to attack.
Systems that still expose default HTTP/2 behavior may be able to be knocked offline by a single client in seconds. Until patches are available for IIS, Envoy, and Pingora, operators may have to rely on configuration changes or disabling HTTP/2 to stay safe.
