New HTTP/2 Bomb Vulnerability Allows Remote DoS on NGINX, Apache, IIS, Envoy & Cloudflare
Researchers found HTTP/2 Bomb, a remote denial-of-service flaw that can exhaust memory on major web servers using default HTTP/2 settings.
Intelligence analysis by GPT-5.4 Mini
Calif says HTTP/2 Bomb combines a compression bomb with a Slowloris-style hold to pin server memory in default HTTP/2 configurations. The issue affects NGINX, Apache HTTPD, Microsoft IIS, Envoy, and Cloudflare Pingora, with patches available for some stacks and mitigations recommended for others.
Researchers found a way to make some web servers waste memory very fast, like stuffing too many tiny sticky notes into a desk drawer until it jams. The trick keeps the door open while the server keeps picking up more notes, so the system slows down or stops.
Analysis
What was found
Cybersecurity researchers say they discovered a remote denial-of-service technique called HTTP/2 Bomb that affects major web servers, including NGINX, Apache HTTPD, Microsoft IIS, Envoy, and Cloudflare Pingora. Calif says the vulnerable behavior exists in each server's default HTTP/2 configuration.
How it works
The attack chains two ideas together: a compression bomb and a Slowloris-style hold. According to Calif, the bomb targets HPACK, HTTP/2's header compression scheme, so a tiny input on the wire can cause large server-side header allocations to be created many times per request. The hold keeps the connection open with a zero-byte flow-control window, which prevents the server from freeing the memory it already allocated.
The company says this is different from older HPACK bomb ideas. In its description, the amplification does not come from stuffing a large value into a table and referencing it repeatedly. Instead, the overhead comes from the bookkeeping each server allocates around a nearly empty header, so decoded-size limits do not trigger in the usual way.
Impact and mitigations
Calif says a home computer on a 100Mbps connection could make a vulnerable server inaccessible within seconds in a hypothetical attack. It also says one client could consume and hold 32GB of server memory against Apache HTTPD and Envoy in about 20 seconds.
The article lists specific mitigations: NGINX should be upgraded to 1.29.8+ or have HTTP/2 disabled with http2 off; if upgrade is not possible. Apache HTTPD is fixed in mod_http2 v2.0.41, and if upgrading is not possible, Protocols http/1.1 is recommended to disable HTTP/2. Microsoft IIS, Envoy, and Cloudflare Pingora reportedly had no patch available at the time of writing.
Key points
- Researchers say HTTP/2 Bomb can trigger remote denial of service on major web servers.
- The attack combines HPACK compression abuse with a Slowloris-style connection hold.
- NGINX and Apache HTTPD have fixes or mitigations available, but IIS, Envoy, and Cloudflare Pingora did not have patches at publication time.
- Calif says the issue exists in default HTTP/2 configurations, raising exposure for common deployments.
Some affected servers already have clear fixes or workarounds, including NGINX and Apache HTTPD. Where patches are not yet available, operators still have configuration options to reduce exposure by turning off HTTP/2 until a fix lands.
Servers left on default HTTP/2 settings may be vulnerable to fast memory exhaustion and service disruption. The article also notes that some affected platforms had no patch available at the time of writing, which could leave defenders relying on temporary mitigations.
