Security researchers have disclosed a new denial-of-service (DoS) technique known as HTTP/2 Bomb, an attack capable of rapidly consuming server memory and making websites unavailable within seconds. The attack targets default HTTP/2 configurations used by several of the world's most widely deployed web server platforms.

The vulnerability affects popular technologies such as nginx, Apache HTTP Server, Microsoft IIS, Envoy, and Cloudflare Pingora. These platforms power a large portion of websites, enterprise applications, and cloud infrastructure worldwide.

Figure 1. Cyber Threat Detection.

The attack was discovered by security researchers at Codex and publicly disclosed in June 2026. Tests showed that even an attacker with a relatively modest 100 Mbps internet connection could force servers to allocate tens of gigabytes of memory in less than a minute. Unlike traditional denial-of-service attacks that rely on overwhelming servers with massive amounts of traffic, HTTP/2 Bomb requires comparatively little bandwidth. Instead, it exploits the way servers manage memory when processing HTTP/2 requests. Figure 1 Cyber Threat Detection.

The HTTP/2 Bomb attack combines two existing HTTP/2 features to create a powerful denial-of-service threat. It abuses HPACK header compression to trigger excessive memory allocations and exploits flow-control mechanisms to keep that memory occupied, allowing attackers to exhaust server resources with minimal bandwidth.

During testing, researchers observed amplification ratios as high as 5,700:1 on Envoy and 4,000:1 on Apache, enabling 32 GB of memory to be consumed in just seconds. nginx and Microsoft IIS were also affected, though to a lesser extent. The researchers also discovered a bypass involving fragmented Cookie headers, which allowed attackers to evade some server-imposed header limits and generate thousands of memory allocations.

MA Shodan scan identified more than 880,000 internet-facing systems running affected HTTP/2 server software [1]. Fixes have been released for nginx and Apache HTTP Server under CVE-2026-49975, while updates for Microsoft IIS, Envoy, and Cloudflare Pingora were still pending at disclosure.

Security experts recommend applying available patches, enforcing stricter header limits, restricting worker-process memory usage, and disabling HTTP/2 where necessary. The attack highlights how seemingly harmless protocol features can be combined to create serious security risks.

Reference:

1. https://cyberinsider.com/new-http-2-bomb-attack-can-exhaust-server-memory-in-seconds/

Cite this article:

Keerthana S (2026), “HTTP/2 Bomb” Exploit Poses Serious Threat to Web Server Stability, AnaTechMaz, pp.190