In early June 2026, cybersecurity researchers from Calif (using the AI agent Codex) discovered a new variant of the HTTP/2 Bomb attack, which operates even from a single client device with an internet connection speed of 100 Mbps.
The attack consists of two stages:
Manipulation of HPACK Compression: In the HTTP/2 protocol, headers are compressed using the HPACK table. The attacker sends an almost empty header but uses hundreds of thousands of instructions to force server it to unpack and constantly reference the same tiny element. This causes a catastrophic memory consumption. server.
Control Flow Blocking: After the memory is filled, the attacker sets the flow-control window size to 0. This causes the server to pause sending a response, keeping the memory busy and maintaining the connection open with periodic 1-byte requests.
A single client can consume up to 32–64 GB of RAM in just 10–20 seconds. Memory consumption varies across different HTTP servers, ranging from approximately 70 bytes for each byte in the index for nginx, IIS, and Pingora, to 4000 bytes in Apache httpd and 5700 in Envoy.
Virtually all major HTTP/2 server implementations in default configurations are vulnerable:
NGINX, Apache HTTPD (mod_http2 module), Microsoft IIS, Envoy, Cloudflare, Pingora
The vulnerability has been patched in nginx 1.29.8 (using the max_headers directive from freenginx, which by default allows processing of no more than 1000 headers), Envoy 1.35.11 and 1.36.7 (mutable_max_request_headers_kb and max_headers_count), Apache mod_http2 2.0.41. There are currently no patches for Microsoft IIS and Cloudflare Pingora.
The HTTP server Angie is not vulnerable as it implemented protection against such attacks back in version 1.8.0, released in 2024.
Source: linux.org.ru
