Cybersecurity researchers have identified a new remote denial-of-service vulnerability called HTTP/2 Bomb that threatens major web servers including NGINX, Apache HTTPD, Microsoft IIS, Envoy, and Cloudflare Pingora.

Key Points

• The HTTP/2 Bomb exploit combines a compression bomb with a Slowloris-style hold to exhaust server memory.
• Attackers can consume 32GB of server memory against Apache HTTPD and Envoy in approximately 20 seconds using a single client.
• The vulnerability bypasses existing decoded-size limits by targeting per-entry bookkeeping rather than the header data itself.
• Patches are currently available for NGINX (version 1.29.8+) and Apache HTTPD (mod_http2 v2.0.41).
• Microsoft IIS, Envoy, and Cloudflare Pingora remain unpatched and vulnerable to this exploit as of the latest disclosure.

Why it Matters

This vulnerability highlights a critical flaw in how HTTP/2 specifications manage memory allocation and connection persistence, allowing low-bandwidth attackers to crash high-capacity servers. Organizations must prioritize patching or disabling HTTP/2 to prevent potential service outages until vendors release comprehensive security updates.