{"id":181901,"date":"2026-06-05T02:48:08","date_gmt":"2026-06-05T00:48:08","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-http-2-bomb-privodyashhaya-k-ischerpaniyu-operativnoj-pamyati"},"modified":"2026-06-05T02:48:08","modified_gmt":"2026-06-05T00:48:08","slug":"uyazvimost-http-2-bomb-privodyashhaya-k-ischerpaniyu-operativnoj-pamyati","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-http-2-bomb-privodyashhaya-k-ischerpaniyu-operativnoj-pamyati","title":{"rendered":"Vulnerabilitatea HTTP\/2 Bomb, care duce la epuizarea memoriei RAM","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

La \u00eenceputul lunii iunie 2026, cercet\u0103torii \u00een securitate cibernetic\u0103 de la compania Calif (cu ajutorul agentului AI Codex) au descoperit o nou\u0103 variant\u0103 a atacului HTTP\/2 Bomb, care func\u021bioneaz\u0103 chiar \u0219i cu un singur dispozitiv client av\u00e2nd o conexiune la internet cu o vitez\u0103 de 100 Mbit\/s.<\/p>\n

Atacul const\u0103 din dou\u0103 etape:<\/p>\n

    \n
  1. \n

    Manipularea comprim\u0103rii HPACK: \u00cen protocolul HTTP\/2, anteturile sunt comprimate folosind tabelul HPACK. Atacatorul trimite un antet aproape gol, dar prin sute de mii de instruc\u021biuni \u00eel for\u021beaz\u0103 serverul<\/a> s\u0103 desfaci \u0219i s\u0103 faci constant referire la acela\u0219i element microscopic. Acest lucru provoac\u0103 o consumare rapid\u0103 a memoriei. server<\/a>.<\/p>\n<\/li>\n

  2. \n

    Bloca\u021bi controlul fluxului: Dup\u0103 ce memoria este umplut\u0103, atacatorul seteaz\u0103 dimensiunea feroniei de control al fluxului (flow-control window) la 0. Acest lucru determin\u0103 serverul s\u0103 opreasc\u0103 trimiterea r\u0103spunsului, men\u021bin\u00e2nd memoria ocupat\u0103 \u0219i p\u0103str\u00e2nd conexiunea deschis\u0103 prin cereri periodice de 1 byte.<\/p>\n<\/li>\n<\/ol>\n

    Un singur client poate consuma \u00eentre 32 \u0219i 64 GB de memorie RAM \u00een 10-20 de secunde. Nivelul de consum al memoriei variaz\u0103 \u00een diferite servere HTTP, de la aproximativ 70 de bytes pentru fiecare byte \u00een indexul nginx, IIS \u0219i Pingora, p\u00e2n\u0103 la 4000 de bytes \u00een Apache httpd \u0219i 5700 \u00een Envoy.<\/p>\n

    Toate implement\u0103rile principale ale serverelor HTTP\/2 \u00een configura\u021biile prestabilite sunt vulnerabile:
    \nNGINX, Apache HTTPD (modul mod_http2), Microsoft IIS, Envoy, Cloudflare, Pingora<\/p>\n

    Vulnerabilitatea a fost corectat\u0103 \u00een nginx 1.29.8 (prin directiva max_headers din freenginx, care permite \u00een mod prestabilit procesarea a nu mai mult de 1000 de antete), Envoy 1.35.11 \u0219i 1.36.7 (mutable_max_request_headers_kb \u0219i max_headers_count), Apache mod_http2 2.0.41. Pentru Microsoft IIS \u0219i Cloudflare Pingora momentan nu exist\u0103 remedieri.<\/p>\n

    Serverul HTTP Angie nu este vulnerabil, deoarece a implementat protec\u021bia \u00eempotriva acestui tip de atac \u00eenc\u0103 din versiunea 1.8.0, lansat\u0103 \u00een 2024.<\/p>\n

    Sursa: linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

    \u0412 \u043d\u0430\u0447\u0430\u043b\u0435 \u0438\u044e\u043d\u044f 2026 \u0433\u043e\u0434\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Calif (\u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0418\u0418-\u0430\u0433\u0435\u043d\u0442\u0430 Codex) \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u043d\u043e\u0432\u044b\u0439 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u0430\u0442\u0430\u043a\u0438 HTTP\/2 Bomb, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0434\u0430\u0436\u0435 \u0441 \u043e\u0434\u043d\u043e\u0433\u043e \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u043e\u0433\u043e \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430, \u0438\u043c\u0435\u044e\u0449\u0435\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0435 \u0441\u043e \u0441\u043a\u043e\u0440\u043e\u0441\u0442\u044c\u044e 100 \u041c\u0431\u0438\u0442\/\u0441. \u0410\u0442\u0430\u043a\u0430 \u0441\u043e\u0441\u0442\u043e\u0438\u0442 \u0438\u0437 \u0434\u0432\u0443\u0445 \u044d\u0442\u0430\u043f\u043e\u0432: \u041c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u044f \u0441\u0436\u0430\u0442\u0438\u0435\u043c HPACK: \u0412 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0435 HTTP\/2 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0438 \u0441\u0436\u0438\u043c\u0430\u044e\u0442\u0441\u044f \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0442\u0430\u0431\u043b\u0438\u0446\u044b HPACK. \u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u0442 \u043f\u043e\u0447\u0442\u0438 \u043f\u0443\u0441\u0442\u043e\u0439 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043e\u043a, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-181901","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilitatea HTTP\/2 Bomb, care duce la epuizarea memoriei RAM | ProHoster","description":"La \u00eenceputul lunii iunie 2026, cercet\u0103torii \u00een securitate cibernetic\u0103 de la compania Calif (cu ajutorul agentului AI Codex) au descoperit o nou\u0103 variant\u0103 a atacului HTTP\/2 Bomb, care func\u021bioneaz\u0103 chiar \u0219i cu un singur dispozitiv client av\u00e2nd.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-http-2-bomb-privodyashhaya-k-ischerpaniyu-operativnoj-pamyati","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c HTTP\/2 Bomb, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u0438\u0441\u0447\u0435\u0440\u043f\u0430\u043d\u0438\u044e \u043e\u043f\u0435\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438 | ProHoster","og:description":"\u0412 \u043d\u0430\u0447\u0430\u043b\u0435 \u0438\u044e\u043d\u044f 2026 \u0433\u043e\u0434\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Calif (\u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0418\u0418-\u0430\u0433\u0435\u043d\u0442\u0430 Codex) \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u043d\u043e\u0432\u044b\u0439 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u0430\u0442\u0430\u043a\u0438 HTTP\/2 Bomb, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0434\u0430\u0436\u0435 \u0441 \u043e\u0434\u043d\u043e\u0433\u043e \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u043e\u0433\u043e \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430, \u0438\u043c\u0435\u044e\u0449\u0435\u0433\u043e.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-http-2-bomb-privodyashhaya-k-ischerpaniyu-operativnoj-pamyati","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-06-05T00:48:08+00:00","article:modified_time":"2026-06-05T00:48:08+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/181901","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=181901"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/181901\/revisions"}],"predecessor-version":[{"id":182083,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/181901\/revisions\/182083"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=181901"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=181901"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=181901"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}