HTTP/2 Bomb DoS Flaw Hits Apache, nginx, IIS, Envoy, and Pingora

Researchers publicly disclosed HTTP/2 Bomb, a remote denial-of-service technique that affects major web servers including Apache httpd, nginx, Microsoft IIS, Envoy, and Cloudflare Pingora under default HTTP/2 configurations. The attack combines HPACK header-compression amplification with an HTTP/2 flow-control stall, letting a low-bandwidth client trigger large memory allocations on the server and keep that memory pinned long enough to degrade or deny service. The disclosure says a single client on a 100 Mbps connection can make vulnerable servers inaccessible within seconds, with Apache httpd and Envoy observed consuming roughly 32 GB of memory in about 20 seconds.

Apache assigned the issue CVE-2026-49975, and the disclosure says nginx and Apache were privately notified before publication. Reported mitigations include upgrading nginx to 1.29.8 or later, using mod_http2 v2.0.41 for Apache, or disabling HTTP/2 where patches are not available. The researchers said limiting decoded header size alone is not enough; affected servers also need hard caps on header count and protections against long-lived stalled streams that retain memory. At the time of disclosure, fixes were reported for nginx and Apache, while IIS, Envoy, and Pingora reportedly had no patch available.