{"id":181899,"date":"2026-06-04T14:48:20","date_gmt":"2026-06-04T12:48:20","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ataka-na-realizaczii-http-2-privodyashhaya-k-ischerpaniyu-dostupnoj-pamyati"},"modified":"2026-06-04T14:48:20","modified_gmt":"2026-06-04T12:48:20","slug":"ataka-na-realizaczii-http-2-privodyashhaya-k-ischerpaniyu-dostupnoj-pamyati","status":"publish","type":"post","link":"https:\/\/prohoster.info\/it\/blog\/news\/ataka-na-realizaczii-http-2-privodyashhaya-k-ischerpaniyu-dostupnoj-pamyati","title":{"rendered":"Attacco alle implementazioni di HTTP\/2 che porta all'esaurimento della memoria disponibile","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Rivelate informazioni su una vulnerabilit\u00e0 \"HTTP\/2 Bomb\" che interessa diverse implementazioni del protocollo HTTP\/2 e consente di causare un'interruzione del servizio esaurendo tutta la memoria disponibile per il processo. Il problema \u00e8 stato confermato nei server HTTP nginx, Apache httpd (CVE-2026-49975), Microsoft IIS, Envoy (CVE-2026-47774) e Cloudflare Pingora nella configurazione predefinita.<\/p>\n

La vulnerabilit\u00e0 utilizza un metodo simile a una bomba zip, applicata alla funzionalit\u00e0 di compressione degli header in HTTP\/2. L'idea \u00e8 che una richiesta possa contenere migliaia di header compressi, come \"Cookie\", senza dati allegati, ognuno dei quali nella richiesta \u00e8 rappresentato da un riferimento a un byte nell'indice HPACK, ma su server<\/a> Il livello di consumo di memoria varia tra i diversi server HTTP, da circa 70 byte per ogni byte nell'indice per nginx, IIS e Pingora, a 4000 byte in Apache httpd e 5700 in Envoy. In un attacco da un computer cliente con una connessione di 100Mbps, per esaurire 32 GB di memoria sono necessari circa 10 secondi attaccando con Envoy 1.37.2, 18 secondi con Apache httpd 2.4.67 e 45 secondi con nginx 1.29.7. server<\/a> Envoy 1.37.2, 18 secondi \u2014 Apache httpd 2.4.67 e 45 secondi \u2014 nginx 1.29.7.<\/p>\n

\u00e8 inclusa nelle release 1.35.11 e 1.36.7, in cui sono stati implementati i limiti mutable_max_request_headers_kb e max_headers_count. In Apache httpd, la correzione \u00e8 proposta nella release del modulo mod_http2 2.0.41, che non \u00e8 ancora stata inclusa nelle release di Apache httpd. Per
\nMicrosoft IIS e Cloudflare Pingora, le correzioni sono attualmente assenti.
\nCome soluzione alternativa per la protezione, \u00e8 possibile disattivare l'uso del protocollo HTTP\/2 e impostare un limite sulla dimensione della memoria disponibile per i processi.
\n\u00c8 stata rivelata un'informazione sulla vulnerabilit\u00e0 \"HTTP\/2 Bomb\", che colpisce diverse implementazioni del protocollo HTTP\/2 e consente di ottenere un'interruzione del servizio attraverso il consumo della memoria disponibile per il processo.
\n
Fonte: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 «HTTP\/2 Bomb», \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0435\u0439 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 HTTP\/2 \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u043e\u0442\u043a\u0430\u0437\u0430 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438 \u0447\u0435\u0440\u0435\u0437 \u0438\u0441\u0447\u0435\u0440\u043f\u0430\u043d\u0438\u0435 \u0432\u0441\u0435\u0439 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0439 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0443 \u043f\u0430\u043c\u044f\u0442\u0438. \u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u043e \u0432 HTTP-\u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 nginx, Apache httpd (CVE-2026-49975), Microsoft IIS, Envoy (CVE-2026-47774) \u0438 Cloudflare Pingora \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u043c\u0435\u0442\u043e\u0434, \u043d\u0430\u043f\u043e\u043c\u0438\u043d\u0430\u044e\u0449\u0438\u0439 zip-\u0431\u043e\u043c\u0431\u0443, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u0443\u044e \u043a \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u0441\u0436\u0430\u0442\u0438\u044f \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u043e\u0432 \u0432 HTTP\/2. […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-181899","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"Attacco a implementazioni HTTP\/2 che porta all'esaurimento della memoria disponibile | ProHoster","description":"\ud83e\udd47Attacco alle implementazioni HTTP\/2 che porta all'esaurimento della memoria disponibile | ProHoster","canonical_url":"https:\/\/prohoster.info\/it\/blog\/news\/ataka-na-realizaczii-http-2-privodyashhaya-k-ischerpaniyu-dostupnoj-pamyati","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"it_IT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0430 \u043d\u0430 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 HTTP\/2, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u0438\u0441\u0447\u0435\u0440\u043f\u0430\u043d\u0438\u044e \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438 | ProHoster","og:description":"\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 "HTTP\/2 Bomb", \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0435\u0439 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 HTTP\/2 \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u043e\u0442\u043a\u0430\u0437\u0430 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438 \u0447\u0435\u0440\u0435\u0437 \u0438\u0441\u0447\u0435\u0440\u043f\u0430\u043d\u0438\u0435 \u0432\u0441\u0435\u0439 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0439 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0443 \u043f\u0430\u043c\u044f\u0442\u0438.","og:url":"https:\/\/prohoster.info\/it\/blog\/news\/ataka-na-realizaczii-http-2-privodyashhaya-k-ischerpaniyu-dostupnoj-pamyati","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-06-04T12:48:20+00:00","article:modified_time":"2026-06-04T12:48:20+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/181899","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/comments?post=181899"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/181899\/revisions"}],"predecessor-version":[{"id":182084,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/181899\/revisions\/182084"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media?parent=181899"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/categories?post=181899"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/tags?post=181899"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}