{"id":181901,"date":"2026-06-05T02:48:08","date_gmt":"2026-06-05T00:48:08","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-http-2-bomb-privodyashhaya-k-ischerpaniyu-operativnoj-pamyati"},"modified":"2026-06-05T02:48:08","modified_gmt":"2026-06-05T00:48:08","slug":"uyazvimost-http-2-bomb-privodyashhaya-k-ischerpaniyu-operativnoj-pamyati","status":"publish","type":"post","link":"https:\/\/prohoster.info\/fr\/blog\/news\/uyazvimost-http-2-bomb-privodyashhaya-k-ischerpaniyu-operativnoj-pamyati","title":{"rendered":"Vuln\u00e9rabilit\u00e9 HTTP\/2 Bomb, entra\u00eenant l'\u00e9puisement de la m\u00e9moire","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Au d\u00e9but juin 2026, des chercheurs en cybers\u00e9curit\u00e9 de la soci\u00e9t\u00e9 Calif (avec l'aide de l'agent IA Codex) ont d\u00e9couvert une nouvelle variante de l'attaque HTTP\/2 Bomb, qui fonctionne m\u00eame depuis un seul appareil client ayant une connexion Internet de 100 Mbit\/s.<\/p>\n

L'attaque se compose de deux \u00e9tapes :<\/p>\n

    \n
  1. \n

    Manipulation de la compression HPACK : Dans le protocole HTTP\/2, les en-t\u00eates sont compress\u00e9s \u00e0 l'aide d'un tableau HPACK. L'attaquant envoie un en-t\u00eate presque vide, mais avec des centaines de milliers d'instructions, il pousse serveur<\/a> \u00e0 d\u00e9compresser et \u00e0 r\u00e9f\u00e9rencer constamment le m\u00eame \u00e9l\u00e9ment minuscule. Cela provoque un gaspillage de m\u00e9moire en avalanche. de serveurs<\/a>.<\/p>\n<\/li>\n

  2. \n

    Blocage de la gestion des flux (Flow Control) : Apr\u00e8s que la m\u00e9moire soit satur\u00e9e, l'attaquant fixe la taille de la fen\u00eatre de contr\u00f4le de flux \u00e0 0. Cela force le serveur \u00e0 suspendre l'envoi de r\u00e9ponse, retenant la m\u00e9moire occup\u00e9e, et \u00e0 maintenir la connexion ouverte par des requ\u00eates de 1 octet \u00e0 intervalles r\u00e9guliers.<\/p>\n<\/li>\n<\/ol>\n

    Un seul client peut consommer jusqu'\u00e0 32 \u00e0 64 Go de RAM en 10 \u00e0 20 secondes. Le niveau de consommation de m\u00e9moire varie d'environ 70 octets pour chaque octet dans l'index pour nginx, IIS et Pingora, jusqu'\u00e0 4000 octets dans Apache httpd et 5700 dans Envoy.<\/p>\n

    Pratiquement toutes les principales impl\u00e9mentations serveurs HTTP\/2 par d\u00e9faut sont vuln\u00e9rables :
    \nNGINX, Apache HTTPD (module mod_http2), Microsoft IIS, Envoy, Cloudflare, Pingora<\/p>\n

    La vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 corrig\u00e9e dans nginx 1.29.8 (avec la directive max_headers de freenginx, qui par d\u00e9faut autorise le traitement de plus de 1000 en-t\u00eates), Envoy 1.35.11 et 1.36.7 (mutable_max_request_headers_kb et max_headers_count), mod_http2 d'Apache 2.0.41. Il n'y a pas encore de correctifs pour Microsoft IIS et Cloudflare Pingora.<\/p>\n

    Le serveur HTTP Angie n'est pas vuln\u00e9rable, car il a mis en \u0153uvre une protection contre ce type d'attaques d\u00e8s la version 1.8.0, sortie en 2024.<\/p>\n

    Source : linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

    \u0412 \u043d\u0430\u0447\u0430\u043b\u0435 \u0438\u044e\u043d\u044f 2026 \u0433\u043e\u0434\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Calif (\u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0418\u0418-\u0430\u0433\u0435\u043d\u0442\u0430 Codex) \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u043d\u043e\u0432\u044b\u0439 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u0430\u0442\u0430\u043a\u0438 HTTP\/2 Bomb, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0434\u0430\u0436\u0435 \u0441 \u043e\u0434\u043d\u043e\u0433\u043e \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u043e\u0433\u043e \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430, \u0438\u043c\u0435\u044e\u0449\u0435\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0435 \u0441\u043e \u0441\u043a\u043e\u0440\u043e\u0441\u0442\u044c\u044e 100 \u041c\u0431\u0438\u0442\/\u0441. \u0410\u0442\u0430\u043a\u0430 \u0441\u043e\u0441\u0442\u043e\u0438\u0442 \u0438\u0437 \u0434\u0432\u0443\u0445 \u044d\u0442\u0430\u043f\u043e\u0432: \u041c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u044f \u0441\u0436\u0430\u0442\u0438\u0435\u043c HPACK: \u0412 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0435 HTTP\/2 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0438 \u0441\u0436\u0438\u043c\u0430\u044e\u0442\u0441\u044f \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0442\u0430\u0431\u043b\u0438\u0446\u044b HPACK. \u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u0442 \u043f\u043e\u0447\u0442\u0438 \u043f\u0443\u0441\u0442\u043e\u0439 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043e\u043a, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-181901","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vuln\u00e9rabilit\u00e9 HTTP\/2 Bomb entra\u00eenant l'\u00e9puisement de la m\u00e9moire vive | ProHoster","description":"Au d\u00e9but juin 2026, des chercheurs en cybers\u00e9curit\u00e9 de la soci\u00e9t\u00e9 Calif (avec l'aide de l'agent IA Codex) ont d\u00e9couvert une nouvelle variante de l'attaque HTTP\/2 Bomb, qui fonctionne m\u00eame depuis un seul appareil client ayant.","canonical_url":"https:\/\/prohoster.info\/fr\/blog\/news\/uyazvimost-http-2-bomb-privodyashhaya-k-ischerpaniyu-operativnoj-pamyati","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"fr_FR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c HTTP\/2 Bomb, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u0438\u0441\u0447\u0435\u0440\u043f\u0430\u043d\u0438\u044e \u043e\u043f\u0435\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438 | ProHoster","og:description":"\u0412 \u043d\u0430\u0447\u0430\u043b\u0435 \u0438\u044e\u043d\u044f 2026 \u0433\u043e\u0434\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Calif (\u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0418\u0418-\u0430\u0433\u0435\u043d\u0442\u0430 Codex) \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u043d\u043e\u0432\u044b\u0439 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u0430\u0442\u0430\u043a\u0438 HTTP\/2 Bomb, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0434\u0430\u0436\u0435 \u0441 \u043e\u0434\u043d\u043e\u0433\u043e \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u043e\u0433\u043e \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430, \u0438\u043c\u0435\u044e\u0449\u0435\u0433\u043e.","og:url":"https:\/\/prohoster.info\/fr\/blog\/news\/uyazvimost-http-2-bomb-privodyashhaya-k-ischerpaniyu-operativnoj-pamyati","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-06-05T00:48:08+00:00","article:modified_time":"2026-06-05T00:48:08+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/181901","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/comments?post=181901"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/181901\/revisions"}],"predecessor-version":[{"id":182083,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/181901\/revisions\/182083"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media?parent=181901"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/categories?post=181901"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/tags?post=181901"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}