{"id":181899,"date":"2026-06-04T14:48:20","date_gmt":"2026-06-04T12:48:20","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ataka-na-realizaczii-http-2-privodyashhaya-k-ischerpaniyu-dostupnoj-pamyati"},"modified":"2026-06-04T14:48:20","modified_gmt":"2026-06-04T12:48:20","slug":"ataka-na-realizaczii-http-2-privodyashhaya-k-ischerpaniyu-dostupnoj-pamyati","status":"publish","type":"post","link":"https:\/\/prohoster.info\/az\/blog\/news\/ataka-na-realizaczii-http-2-privodyashhaya-k-ischerpaniyu-dostupnoj-pamyati","title":{"rendered":"HTTP\/2-nin icra edilm\u0259sin\u0259 qar\u015f\u0131 h\u00fccum, m\u00f6vcud yadda\u015f\u0131n t\u00fck\u0259nm\u0259sin\u0259 s\u0259b\u0259b olur","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

HTTP\/2 Bomb" z\u0259r\u0259rliyinin m\u00fcxt\u0259lif HTTP\/2 protokol icralar\u0131na t\u0259sir etdiyi v\u0259 prosesi tam yadda\u015fdan azad ed\u0259r\u0259k xidm\u0259td\u0259 dayand\u0131r\u0131lmaya s\u0259b\u0259b oldu\u011fu il\u0259 ba\u011fl\u0131 m\u0259lumatlar a\u00e7\u0131qlan\u0131b. Problemin nginx, Apache httpd (CVE-2026-49975), Microsoft IIS, Envoy (CVE-2026-47774) v\u0259 Cloudflare Pingora standart konfiqurasiyas\u0131nda t\u0259sdiql\u0259ndiyi qeyd olunur.<\/p>\n

Z\u0259r\u0259rli kod, HTTP\/2-d\u0259 ba\u015fl\u0131q s\u0131x\u0131\u015fd\u0131rma funksionall\u0131\u011f\u0131na t\u0259tbiq olunan zip bombas\u0131na b\u0259nz\u0259r bir metodu istifad\u0259 edir. Fikir ondan ibar\u0259tdir ki, sor\u011fuda "Cookie" kimi minl\u0259rl\u0259 s\u0131x\u0131lm\u0131\u015f ba\u015fl\u0131q ola bil\u0259r, lakin \u0259lav\u0259 m\u0259lumat olmadan, h\u0259r biri HPACK indeksind\u0259 bir baytl\u0131q istinadla t\u0259qdim olunur. Ancaq sunucusu<\/a> \u015famil oldu\u011fu ba\u015fl\u0131q \u00fc\u00e7\u00fcn tam yadda\u015f ayr\u0131lmas\u0131n\u0131 t\u0259l\u0259b edir. M\u00fcxt\u0259lif HTTP serverl\u0259rind\u0259 yadda\u015f istehlak s\u0259viyy\u0259si, nginx, IIS v\u0259 Pingora \u00fc\u00e7\u00fcn h\u0259r bir indeks bayt\u0131 \u00fc\u00e7\u00fcn t\u0259xmin\u0259n 70 baytdan, Apache httpd-d\u0259 4000 bayta v\u0259 Envoy-da 5700 bayta q\u0259d\u0259r d\u0259yi\u015fir. 100Mbps ba\u011flant\u0131ya malik bir istehlak\u00e7\u0131 komp\u00fcterind\u0259n edil\u0259n bir h\u00fccumda, 32 GB yadda\u015f\u0131 bitirm\u0259k \u00fc\u00e7\u00fcn t\u0259xmin\u0259n 10 saniy\u0259, server<\/a> Envoy 1.37.2 il\u0259 18 saniy\u0259 \u2014 Apache httpd 2.4.67 v\u0259 45 saniy\u0259 \u2014 nginx 1.29.7.<\/p>\n

Z\u0259iflinin qar\u015f\u0131s\u0131n\u0131 almaq \u00fc\u00e7\u00fcn nginx 1.29.8 versiyas\u0131nda freenginx layih\u0259sind\u0259n max_headers direktivi k\u00f6\u00e7\u00fcr\u00fclm\u00fc\u015fd\u00fcr, bu, standart olaraq 1000-d\u0259n \u00e7ox ba\u015fl\u0131\u011f\u0131n emal\u0131na icaz\u0259 verir. Envoy-da d\u00fcz\u0259li\u015f
\n1.35.11 v\u0259 1.36.7 versiyalar\u0131na daxil edilmi\u015fdir, burada mutable_max_request_headers_kb v\u0259 max_headers_count limitl\u0259ri t\u0259tbiq olunmu\u015fdur. Apache httpd-d\u0259 d\u00fcz\u0259li\u015f mod_http2 2.0.41 modulu versiyas\u0131nda t\u0259qdim edildi, bu is\u0259 h\u0259l\u0259 Apache httpd-nin burax\u0131l\u0131\u015flar\u0131na daxil edilm\u0259mi\u015fdir.
\nMicrosoft IIS v\u0259 Cloudflare Pingora \u00fc\u00e7\u00fcn h\u0259l\u0259 d\u00fcz\u0259li\u015fl\u0259r m\u00f6vcud deyil.
\nQoruma \u00fc\u00e7\u00fcn alternativ yolu HTTP\/2 protokolunun istifad\u0259sini dayand\u0131rmaq v\u0259 i\u015f\u00e7i prosesl\u0259r \u00fc\u00e7\u00fcn \u0259l\u00e7atan yadda\u015f \u00f6l\u00e7\u00fcs\u00fcn\u00fcn limitini t\u0259yin etm\u0259kdir.
\n
M\u0259nb\u0259: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 «HTTP\/2 Bomb», \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0435\u0439 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 HTTP\/2 \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u043e\u0442\u043a\u0430\u0437\u0430 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438 \u0447\u0435\u0440\u0435\u0437 \u0438\u0441\u0447\u0435\u0440\u043f\u0430\u043d\u0438\u0435 \u0432\u0441\u0435\u0439 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0439 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0443 \u043f\u0430\u043c\u044f\u0442\u0438. \u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u043e \u0432 HTTP-\u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 nginx, Apache httpd (CVE-2026-49975), Microsoft IIS, Envoy (CVE-2026-47774) \u0438 Cloudflare Pingora \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u043c\u0435\u0442\u043e\u0434, \u043d\u0430\u043f\u043e\u043c\u0438\u043d\u0430\u044e\u0449\u0438\u0439 zip-\u0431\u043e\u043c\u0431\u0443, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u0443\u044e \u043a \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u0441\u0436\u0430\u0442\u0438\u044f \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u043e\u0432 \u0432 HTTP\/2. […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-181899","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47HTTP\/2 icralar\u0131na olan h\u00fccum, \u0259l\u00e7atan yadda\u015f\u0131n t\u00fck\u0259nm\u0259sin\u0259 s\u0259b\u0259b olur | ProHoster","description":"\u00abHTTP\/2 Bomb\u00bb z\u0259ifliyi haqq\u0131nda m\u0259lumat, HTTP\/2 protokolunun m\u00fcxt\u0259lif icralar\u0131n\u0131 \u0259hat\u0259 edir v\u0259 b\u00fct\u00fcn m\u00f6vcud proses yadda\u015f\u0131n\u0131 t\u00fck\u0259ndir\u0259r\u0259k xidm\u0259tin dayand\u0131r\u0131lmas\u0131na imkan tan\u0131y\u0131r.","canonical_url":"https:\/\/prohoster.info\/az\/blog\/news\/ataka-na-realizaczii-http-2-privodyashhaya-k-ischerpaniyu-dostupnoj-pamyati","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"az_AZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0430 \u043d\u0430 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 HTTP\/2, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u0438\u0441\u0447\u0435\u0440\u043f\u0430\u043d\u0438\u044e \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438 | ProHoster","og:description":"\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 "HTTP\/2 Bomb", \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0435\u0439 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 HTTP\/2 \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u043e\u0442\u043a\u0430\u0437\u0430 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438 \u0447\u0435\u0440\u0435\u0437 \u0438\u0441\u0447\u0435\u0440\u043f\u0430\u043d\u0438\u0435 \u0432\u0441\u0435\u0439 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0439 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0443 \u043f\u0430\u043c\u044f\u0442\u0438.","og:url":"https:\/\/prohoster.info\/az\/blog\/news\/ataka-na-realizaczii-http-2-privodyashhaya-k-ischerpaniyu-dostupnoj-pamyati","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-06-04T12:48:20+00:00","article:modified_time":"2026-06-04T12:48:20+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/posts\/181899","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/comments?post=181899"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/posts\/181899\/revisions"}],"predecessor-version":[{"id":182084,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/posts\/181899\/revisions\/182084"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/media?parent=181899"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/categories?post=181899"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/tags?post=181899"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}