NewsPublished 3 Jun 2026

‘HTTP/2 Bomb’ Exploit Knocks Web Servers Offline in Seconds

Source SecurityWeek

Mentions 4 CVEs

Mentioned vulnerabilities

Description

The default HTTP/2 configuration of major web servers is vulnerable to an attack chain combining a compression bomb and a Slowloris-style hold. The post ‘HTTP/2 Bomb’ Exploit Knocks Web Servers Offline in Seconds appeared first on SecurityWeek .

Impact

The exploit causes denial-of-service conditions by rapidly exhausting server memory and resources, rendering affected web servers unavailable within seconds. This impacts a large number of websites using default HTTP/2 configurations on major web servers. The attack requires relatively low bandwidth and can be executed from a home internet connection. No evidence of exploitation in the wild has been reported at the time of disclosure.

Defensive guidance

Patches addressing this exploit have been released for NGINX (April 2026) and Apache HTTPD (May 2026, CVE-2026-49975). Administrators of these servers should apply these official fixes promptly. Microsoft IIS, Envoy, and Cloudflare Pingora remain unpatched; monitor vendor advisories for updates. Until patches are available, consider disabling HTTP/2 or applying configuration changes that limit header-field counts and flow-control window manipulations if feasible. No vendor advisory indicates that no action is required or that the issue is already mitigated. Patch status for some affected servers is pending; check vendor advisories regularly.

Summary

The HTTP/2 Bomb exploit chains together multiple known vulnerabilities: CVE-2016-6581 (HPACK Bomb compression attack), CVE-2016-8740 and CVE-2016-1546 (Slow Read vulnerabilities causing memory exhaustion via HTTP/2 flow-control manipulation). The attack leverages a nearly empty header that triggers excessive per-entry bookkeeping memory allocation on servers, bypassing typical decoded header size limits. This results in rapid resource exhaustion and denial of service. The exploit was discovered by combining existing public vulnerabilities using AI-assisted code analysis. NGINX patched the issue in April 2026, Apache HTTPD patched it in late May 2026 (CVE-2026-49975), but other major HTTP/2 supporting servers remain vulnerable. The attack can be launched from a modest 100 Mbps connection and affects default server configurations.

References

securityweek.com/http-2-bomb-exploit-knocks-web-servers-offline-in-seconds/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 3 Jun 2026, 11:03 UTC

References

Community reviews

Related threats