Information about the "HTTP/2 Bomb" vulnerability has been revealed, affecting various implementations of the HTTP/2 protocol and allowing for denial of service through the exhaustion of all available memory for the process. The issue has been confirmed in HTTP servers such as nginx, Apache httpd (CVE-2026-49975), Microsoft IIS, Envoy (CVE-2026-47774), and Cloudflare Pingora in their default configurations.
The vulnerability uses a method similar to a zip bomb applied to the header compression functionality in HTTP/2. The idea is that a request can contain thousands of compressed headers, such as "Cookie", without attached data, each represented in the request by a one-byte reference in the HPACK index, but requires full memory allocation for the entire header. servern The memory consumption level varies between different HTTP servers, from approximately 70 bytes for each byte in the index for nginx, IIS, and Pingora, to 4000 bytes for Apache httpd and 5700 for Envoy. When attacking from a consumer computer with a 100Mbps connection, exhausting 32 GB of memory takes around 10 seconds when targeting Envoy 1.37.2, 18 seconds for Apache httpd 2.4.67, and 45 seconds for nginx 1.29.7. server To block the vulnerability, the max_headers directive was transferred in the nginx 1.29.8 release from the freenginx project, which by default allows the processing of no more than 1000 headers. In Envoy, the fix is included in the 1.35.11 and 1.36.7 releases, where limits for mutable_max_request_headers_kb and max_headers_count have been implemented. In Apache httpd, the fix has been proposed in the mod_http2 2.0.41 module release, which has not yet been included in Apache httpd releases.
For Microsoft IIS and Cloudflare Pingora, fixes are currently not available.
As a workaround for protection, one can disable the use of the HTTP/2 protocol and set a limit on the amount of memory available for worker processes.
Information about the "HTTP/2 Bomb" vulnerability has been revealed, affecting various implementations of the HTTP/2 protocol and allowing for denial of service through the exhaustion of all available memory for the process.
đ„Attack on HTTP/2 implementations leading to available memory exhaustion | ProHoster
KĂ€lla: opennet.ru
