{"id":181899,"date":"2026-06-04T14:48:20","date_gmt":"2026-06-04T12:48:20","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ataka-na-realizaczii-http-2-privodyashhaya-k-ischerpaniyu-dostupnoj-pamyati"},"modified":"2026-06-04T14:48:20","modified_gmt":"2026-06-04T12:48:20","slug":"ataka-na-realizaczii-http-2-privodyashhaya-k-ischerpaniyu-dostupnoj-pamyati","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/ataka-na-realizaczii-http-2-privodyashhaya-k-ischerpaniyu-dostupnoj-pamyati","title":{"rendered":"Sulmi n\u00eb implementimet e HTTP\/2 q\u00eb \u00e7on n\u00eb shfryt\u00ebzimin e memories s\u00eb disponueshme","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Informacioni mbi vulnerabilitetin \"HTTP\/2 Bomb\" \u00ebsht\u00eb zbuluar, i cili ndikon n\u00eb implementime t\u00eb ndryshme t\u00eb protokollit HTTP\/2 dhe lejon arritjen e nj\u00eb gjendjeje t\u00eb pap\u00ebrpunuar p\u00ebrmes shterimit t\u00eb gjith\u00eb memories t\u00eb disponueshme p\u00ebr procesin. Prania e problemit \u00ebsht\u00eb konfirmuar n\u00eb serverat HTTP nginx, Apache httpd (CVE-2026-49975), Microsoft IIS, Envoy (CVE-2026-47774) dhe Cloudflare Pingora n\u00eb konfigurim t\u00eb paracaktuar.<\/p>\n

Vulnerabiliteti p\u00ebrdor nj\u00eb metod\u00eb t\u00eb ngjashme me bomb\u00ebn zip, e p\u00ebrdorur n\u00eb funksionalitetin e kompresimit t\u00eb titujve n\u00eb HTTP\/2. Ideja \u00ebsht\u00eb q\u00eb k\u00ebrkesa mund t\u00eb p\u00ebrmbaj\u00eb mij\u00ebra tituj t\u00eb kompresuar, si \"Cookie\", pa t\u00eb dh\u00ebna t\u00eb ngjitura, secili prej t\u00eb cil\u00ebve n\u00eb k\u00ebrkes\u00eb paraqitet me nj\u00eb referenc\u00eb nj\u00eb byte n\u00eb indeksin HPACK, por n\u00eb server<\/a> k\u00ebrkon nj\u00eb alokim t\u00eb plot\u00eb t\u00eb memories p\u00ebr gjith\u00eb titullin. Shkalla e shpenzimit t\u00eb memories n\u00eb server\u00ebt HTTP t\u00eb ndrysh\u00ebm varion nga rreth 70 bytes p\u00ebr \u00e7do byte n\u00eb indeks p\u00ebr nginx, IIS dhe Pingora, deri n\u00eb 4000 bytes n\u00eb Apache httpd dhe 5700 n\u00eb Envoy. Gjat\u00eb nj\u00eb sulmi nga nj\u00eb kompjuter konsumator, q\u00eb ka nj\u00eb lidhje 100Mbps, duhen rreth 10 sekonda p\u00ebr t\u00eb shteruar 32 GB memorie kur sulmohet server<\/a> me Envoy 1.37.2, 18 sekonda \u2014 Apache httpd 2.4.67 dhe 45 sekonda \u2014 nginx 1.29.7.<\/p>\n

P\u00ebr t\u00eb bllokuar vulnerabilitetin, n\u00eb versionin nginx 1.29.8 nga projekti freenginx \u00ebsht\u00eb transferuar direktiva max_headers, e cila nga e defaulti lejon p\u00ebrpunimin e m\u00eb shum\u00eb se 1000 titujve. N\u00eb Envoy, rregullimi
\n\u00ebsht\u00eb p\u00ebrfshir\u00eb n\u00eb versionet 1.35.11 dhe 1.36.7, ku jan\u00eb implementuar kufij t\u00eb ndrysh\u00ebm mutable_max_request_headers_kb dhe max_headers_count. N\u00eb Apache httpd, rregullimi \u00ebsht\u00eb propozuar n\u00eb versionin e modulit mod_http2 2.0.41, i cili ende nuk ka hyr\u00eb n\u00eb l\u00ebshimet e Apache httpd. P\u00ebr
\nMicrosoft IIS dhe Cloudflare Pingora, rregullimet ende mungojn\u00eb.
\nSi nj\u00eb zgjidhje p\u00ebr mbrojtje, mund t\u00eb \u00e7aktivizoni p\u00ebrdorimin e protokollit HTTP\/2 dhe t\u00eb vendosni nj\u00eb kufi mbi madh\u00ebsin\u00eb e memories t\u00eb disponueshme p\u00ebr proceset.
\n
Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 «HTTP\/2 Bomb», \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0435\u0439 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 HTTP\/2 \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u043e\u0442\u043a\u0430\u0437\u0430 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438 \u0447\u0435\u0440\u0435\u0437 \u0438\u0441\u0447\u0435\u0440\u043f\u0430\u043d\u0438\u0435 \u0432\u0441\u0435\u0439 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0439 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0443 \u043f\u0430\u043c\u044f\u0442\u0438. \u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u043e \u0432 HTTP-\u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 nginx, Apache httpd (CVE-2026-49975), Microsoft IIS, Envoy (CVE-2026-47774) \u0438 Cloudflare Pingora \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u043c\u0435\u0442\u043e\u0434, \u043d\u0430\u043f\u043e\u043c\u0438\u043d\u0430\u044e\u0449\u0438\u0439 zip-\u0431\u043e\u043c\u0431\u0443, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u0443\u044e \u043a \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u0441\u0436\u0430\u0442\u0438\u044f \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u043e\u0432 \u0432 HTTP\/2. […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-181899","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Sulmi ndaj zbatimeve t\u00eb HTTP\/2, q\u00eb \u00e7on n\u00eb shterimin e memories t\u00eb disponueshme | ProHoster","description":"Informacioni mbi nj\u00eb vulnerabilitet \"HTTP\/2 Bomb\" \u00ebsht\u00eb zbuluar, i cili prek zbatime t\u00eb ndryshme t\u00eb protokollit HTTP\/2 dhe lejon arritjen e munges\u00ebs n\u00eb sh\u00ebrbim p\u00ebrmes shterimit t\u00eb gjith\u00eb memories t\u00eb disponueshme p\u00ebr procesin.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/ataka-na-realizaczii-http-2-privodyashhaya-k-ischerpaniyu-dostupnoj-pamyati","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0430 \u043d\u0430 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 HTTP\/2, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u0438\u0441\u0447\u0435\u0440\u043f\u0430\u043d\u0438\u044e \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438 | ProHoster","og:description":"\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 "HTTP\/2 Bomb", \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0435\u0439 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 HTTP\/2 \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u043e\u0442\u043a\u0430\u0437\u0430 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438 \u0447\u0435\u0440\u0435\u0437 \u0438\u0441\u0447\u0435\u0440\u043f\u0430\u043d\u0438\u0435 \u0432\u0441\u0435\u0439 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0439 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0443 \u043f\u0430\u043c\u044f\u0442\u0438.","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/ataka-na-realizaczii-http-2-privodyashhaya-k-ischerpaniyu-dostupnoj-pamyati","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-06-04T12:48:20+00:00","article:modified_time":"2026-06-04T12:48:20+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/181899","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=181899"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/181899\/revisions"}],"predecessor-version":[{"id":182084,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/181899\/revisions\/182084"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=181899"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=181899"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=181899"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}