Vulnerability Overview

Disclosed in early June 2026, the HTTP/2 Bomb (CVE-2026-49975) is a severe denial-of-service (DoS) vulnerability affecting multiple major web servers, ingress gateways, and reverse proxies, including NGINX, Envoy, and Apache HTTPD.

Unlike standard volume-based DoS attacks that rely on huge amounts of network bandwidth, the HTTP/2 Bomb leverages a structural flaw in HTTP/2's frame compression algorithm (HPACK). An unauthenticated attacker using a single, low-bandwidth internet connection can exhaust host server memory within seconds, forcing the target server to crash and become completely unresponsive.

Technical Details

HTTP/2 uses HPACK compression to minimize header sizes. HPACK keeps a dynamic table of header fields on both the client and the server.

The HTTP/2 Bomb exploit combines two main techniques:

1. Compression Bomb (HPACK): The attacker sends a stream of headers containing highly compressed, recursive references. When the server processes these, it allocates large amounts of memory to store the decompressed table entries.
2. Slowloris Hold: By advertising a zero-byte flow control window, the attacker prevents the server from sending responses, keeping these memory allocations pinned and preventing garbage collection.

Mitigation & Remediation

Web administrators managing public facing proxy servers must apply upgrades or tweak configuration limits.

1. Upgrade Web Server

Update NGINX to version 1.29.8 or higher (or equivalent versions for other web servers). These versions introduce limits on recursive HPACK decompression dictionary allocations.

# NGINX update check
nginx -v

2. Configure Limits (NGINX Mitigation)

If you cannot upgrade immediately, enforce limits on header sizes and connection allocations in your nginx.conf:

# Limit HTTP/2 header buffer sizes
http {
    keepalive_timeout 65;
    client_header_buffer_size 1k;
    large_client_header_buffers 4 8k;
    
    # Restrict maximum active streams
    http2_max_concurrent_streams 64;
}