{"id":181899,"date":"2026-06-04T14:48:20","date_gmt":"2026-06-04T12:48:20","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ataka-na-realizaczii-http-2-privodyashhaya-k-ischerpaniyu-dostupnoj-pamyati"},"modified":"2026-06-04T14:48:20","modified_gmt":"2026-06-04T12:48:20","slug":"ataka-na-realizaczii-http-2-privodyashhaya-k-ischerpaniyu-dostupnoj-pamyati","status":"publish","type":"post","link":"https:\/\/prohoster.info\/fr\/blog\/news\/ataka-na-realizaczii-http-2-privodyashhaya-k-ischerpaniyu-dostupnoj-pamyati","title":{"rendered":"Attaque sur des impl\u00e9mentations HTTP\/2 entra\u00eenant l'\u00e9puisement de la m\u00e9moire disponible","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Des informations ont \u00e9t\u00e9 r\u00e9v\u00e9l\u00e9es concernant la vuln\u00e9rabilit\u00e9 \u00ab HTTP\/2 Bomb \u00bb, touchant plusieurs impl\u00e9mentations du protocole HTTP\/2 et permettant un d\u00e9ni de service en \u00e9puisant toute la m\u00e9moire disponible du processus. La probl\u00e9matique a \u00e9t\u00e9 confirm\u00e9e sur les serveurs HTTP nginx, Apache httpd (CVE-2026-49975), Microsoft IIS, Envoy (CVE-2026-47774) et Cloudflare Pingora dans la configuration par d\u00e9faut.<\/p>\n

La vuln\u00e9rabilit\u00e9 utilise une m\u00e9thode similaire \u00e0 celle de la zip-bombe, appliqu\u00e9e \u00e0 la fonctionnalit\u00e9 de compression des en-t\u00eates dans HTTP\/2. L'id\u00e9e est que la requ\u00eate peut contenir des milliers d'en-t\u00eates compress\u00e9s, tels que \u00ab Cookie \u00bb, sans donn\u00e9es jointes, chacun \u00e9tant dans la requ\u00eate repr\u00e9sent\u00e9 par une r\u00e9f\u00e9rence \u00e0 un octet dans l'index HPACK, mais sur le serveur<\/a> une allocation compl\u00e8te de m\u00e9moire pour l'ensemble de l'en-t\u00eate. Le niveau de consommation m\u00e9moire dans diff\u00e9rents serveurs HTTP varie d'environ 70 octets pour chaque octet dans l'index pour nginx, IIS et Pingora, jusqu'\u00e0 4000 octets dans Apache httpd et 5700 dans Envoy. Lors d'une attaque depuis un ordinateur personnel ayant une connexion de 100 Mbps, il faut environ 10 secondes pour \u00e9puiser 32 Go de m\u00e9moire lors d'une attaque contre serveur<\/a> Envoy 1.37.2, 18 secondes \u2014 Apache httpd 2.4.67 et 45 secondes \u2014 nginx 1.29.7.<\/p>\n

Pour bloquer la vuln\u00e9rabilit\u00e9, la directive max_headers a \u00e9t\u00e9 d\u00e9plac\u00e9e dans la version 1.29.8 de nginx du projet freenginx, qui par d\u00e9faut autorise le traitement de plus de 1000 en-t\u00eates. Dans Envoy, le correctif
\na \u00e9t\u00e9 inclus dans les versions 1.35.11 et 1.36.7, dans lesquelles sont mis en \u0153uvre les limites mutable_max_request_headers_kb et max_headers_count. Dans Apache httpd, le correctif a \u00e9t\u00e9 propos\u00e9 dans la version du module mod_http2 2.0.41, qui n'a pas encore \u00e9t\u00e9 int\u00e9gr\u00e9e dans les versions d'Apache httpd. Pour
\nMicrosoft IIS et Cloudflare Pingora, des correctifs sont encore absents.
\nComme solution de contournement pour la protection, il est possible de d\u00e9sactiver l'utilisation du protocole HTTP\/2 et de d\u00e9finir une limite sur la quantit\u00e9 de m\u00e9moire disponible pour les processus.
\n
Source : opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 «HTTP\/2 Bomb», \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0435\u0439 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 HTTP\/2 \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u043e\u0442\u043a\u0430\u0437\u0430 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438 \u0447\u0435\u0440\u0435\u0437 \u0438\u0441\u0447\u0435\u0440\u043f\u0430\u043d\u0438\u0435 \u0432\u0441\u0435\u0439 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0439 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0443 \u043f\u0430\u043c\u044f\u0442\u0438. \u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u043e \u0432 HTTP-\u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 nginx, Apache httpd (CVE-2026-49975), Microsoft IIS, Envoy (CVE-2026-47774) \u0438 Cloudflare Pingora \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u043c\u0435\u0442\u043e\u0434, \u043d\u0430\u043f\u043e\u043c\u0438\u043d\u0430\u044e\u0449\u0438\u0439 zip-\u0431\u043e\u043c\u0431\u0443, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u0443\u044e \u043a \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u0441\u0436\u0430\u0442\u0438\u044f \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u043e\u0432 \u0432 HTTP\/2. […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-181899","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Attaque sur des impl\u00e9mentations HTTP\/2, entra\u00eenant l'\u00e9puisement de la m\u00e9moire disponible | ProHoster","description":"Des informations ont \u00e9t\u00e9 r\u00e9v\u00e9l\u00e9es sur la vuln\u00e9rabilit\u00e9 \"HTTP\/2 Bomb\", affectant diverses impl\u00e9mentations du protocole HTTP\/2 et permettant de provoquer un d\u00e9ni de service en \u00e9puissant toute la m\u00e9moire disponible du processus.","canonical_url":"https:\/\/prohoster.info\/fr\/blog\/news\/ataka-na-realizaczii-http-2-privodyashhaya-k-ischerpaniyu-dostupnoj-pamyati","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"fr_FR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0430 \u043d\u0430 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 HTTP\/2, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u0438\u0441\u0447\u0435\u0440\u043f\u0430\u043d\u0438\u044e \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438 | ProHoster","og:description":"\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 "HTTP\/2 Bomb", \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0435\u0439 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 HTTP\/2 \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u043e\u0442\u043a\u0430\u0437\u0430 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438 \u0447\u0435\u0440\u0435\u0437 \u0438\u0441\u0447\u0435\u0440\u043f\u0430\u043d\u0438\u0435 \u0432\u0441\u0435\u0439 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0439 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0443 \u043f\u0430\u043c\u044f\u0442\u0438.","og:url":"https:\/\/prohoster.info\/fr\/blog\/news\/ataka-na-realizaczii-http-2-privodyashhaya-k-ischerpaniyu-dostupnoj-pamyati","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-06-04T12:48:20+00:00","article:modified_time":"2026-06-04T12:48:20+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/181899","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/comments?post=181899"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/181899\/revisions"}],"predecessor-version":[{"id":182084,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/181899\/revisions\/182084"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media?parent=181899"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/categories?post=181899"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/tags?post=181899"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}