Information has been revealed about the "HTTP/2 Bomb" vulnerability, affecting various implementations of the HTTP/2 protocol and allowing for denial of service via exhaustion of all available memory of the process. The issue has been confirmed in HTTP servers such as nginx, Apache httpd (CVE-2026-49975), Microsoft IIS, Envoy (CVE-2026-47774), and Cloudflare Pingora in default configuration.
The vulnerability employs a method reminiscent of a zip bomb, applied to the header compression functionality in HTTP/2. The idea is that a request can contain thousands of compressed headers, such as "Cookie", without attached data, each represented in the request by a single-byte reference in the HPACK index, but requiring. server full memory allocation for each header. Memory consumption varies across different HTTP servers, ranging from about 70 bytes per byte in the index for nginx, IIS, and Pingora, to 4000 bytes in Apache httpd and 5700 in Envoy. When attacking from a consumer computer with a 100Mbps connection, it takes about 10 seconds to exhaust 32 GB of memory when targeting. server Envoy 1.37.2, 18 seconds for Apache httpd 2.4.67, and 45 seconds for nginx 1.29.7.
To block the vulnerability, the max_headers directive was carried over from the freenginx project to nginx version 1.29.8, which by default allows processing of no more than 1000 headers. In Envoy, the fix.
has been included in version releases 1.35.11 and 1.36.7, which have implemented the mutable_max_request_headers_kb and max_headers_count limits. In Apache httpd, the fix is proposed in the mod_http2 module release 2.0.41, which has not yet made it into Apache httpd releases. For.
Microsoft IIS and Cloudflare Pingora, fixes are not yet available.
As a workaround for protection, HTTP/2 protocol usage can be disabled and a limit can be set on the amount of memory available for worker processes.
Source: opennet.ru
