The HTTP/2 Bomb exploit chains together multiple known vulnerabilities: CVE-2016-6581 (HPACK Bomb compression attack), CVE-2016-8740 and CVE-2016-1546 (Slow Read vulnerabilities causing memory exhaustion via HTTP/2 flow-control manipulation). The attack leverages a nearly empty header that triggers excessive per-entry bookkeeping memory allocation on servers, bypassing typical decoded header size limits. This results in rapid resource exhaustion and denial of service. The exploit was discovered by combining existing public vulnerabilities using AI-assisted code analysis. NGINX patched the issue in April 2026, Apache HTTPD patched it in late May 2026 (CVE-2026-49975), but other major HTTP/2 supporting servers remain vulnerable. The attack can be launched from a modest 100 Mbps connection and affects default server configurations.

The exploit causes denial-of-service conditions by rapidly exhausting server memory and resources, rendering affected web servers unavailable within seconds. This impacts a large number of websites using default HTTP/2 configurations on major web servers. The attack requires relatively low bandwidth and can be executed from a home internet connection. No evidence of exploitation in the wild has been reported at the time of disclosure.

Patches addressing this exploit have been released for NGINX (April 2026) and Apache HTTPD (May 2026, CVE-2026-49975). Administrators of these servers should apply these official fixes promptly. Microsoft IIS, Envoy, and Cloudflare Pingora remain unpatched; monitor vendor advisories for updates. Until patches are available, consider disabling HTTP/2 or applying configuration changes that limit header-field counts and flow-control window manipulations if feasible. No vendor advisory indicates that no action is required or that the issue is already mitigated. Patch status for some affected servers is pending; check vendor advisories regularly.