HTTP/2 Bomb — Remote DoS via HPACK Indexed-Reference Compression Bomb + Zero-Window Flow-Control Hold Affecting nginx, Apache httpd, IIS, Envoy & Cloudflare Pingora (CVE-2026-49975, Public PoC) — Threadlinqs Intelligence
As of 2026-06-03, HTTP/2 Bomb — Remote DoS via HPACK Indexed-Reference Compression Bomb + Zero-Window Flow-Control Hold Affecting nginx, Apache httpd, IIS, Envoy & Cloudflare Pingora (CVE-2026-49975, Public PoC) is a high-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 14 indicators of compromise.
Threat ID: TL-2026-0668 · Severity: HIGH · CVSS: 7.5 · Status: ACTIVE · Category: VULNERABILITY
HTTP/2 Bomb is a remote, unauthenticated denial-of-service technique that chains an HPACK (RFC 7541) dynamic-table indexed-reference compression bomb with a Slowloris-style zero-window HTTP/2
HTTP/2 Bomb is a memory-exhaustion denial-of-service technique against the default HTTP/2 stacks of the most widely deployed web servers and reverse proxies. It composes two individually known primitives into a single highly effective request, and was surfaced when researcher Quang Luong used OpenAI Codex to explore HTTP/2 attack surface; Jun Rong and Duc Phan confirmed cross-server exploitability.
PRIMITIVE 1 — HPACK Indexed-Reference Compression Bomb (RFC 7541): HTTP/2 uses HPACK stateful header compression. A client inserts one header into the connection's dynamic table, then emits thousands of 1-byte indexed references to that entry inside a single HEADERS frame. On every reference the receiver looks up the index and materializes a fresh full copy of the header field into the request it is assembling. Each reference costs the attacker exactly one byte on the wire but forces the server to allocate from ~70 bytes (nginx, IIS, Pingora) up to ~4,000 bytes (Apache httpd, Envoy) per reference, yielding wire-to-memory amplification ratios from ~62:1 to ~5,700:1.
PRIMITIVE 2 — Zero-Window Flow-Control Hold (RFC 9113): Standard amplification is transient because the server frees the buffers once it finishes the response. The attacker defeats this by advertising a zero-byte HTTP/2 flow-control window (SETTINGS_INITIAL_WINDOW_SIZE = 0 and/or a zero per-stream window), so the server can never transmit and free its response. A slow drip of 1-byte WINDOW_UPDATE frames continually resets the server's send/idle timeout, pinning every allocation in place indefinitely. This converts a one-shot amplification into a persistent, accumulating memory hold across many parallel streams on one connection.
HEADER-COUNT-CAP BYPASS (Cookie crumbs, RFC 9113 §8.2.3): Servers that defend by capping the NUMBER of header fields rather than the decoded SIZE (Apache httpd, Envoy) are bypassed using the Cookie header. RFC 9113 §8.2.3 permits splitting a Cookie header into many individual 'crumb' fields for better compression; vulnerable servers did not count these crumbs against their field-count limit (e.g. Apache's LimitRequestFields). On Envoy each crumb is appended to a growing buffer (~3,600:1 logical, ~5,700:1 measured); on Apache httpd the merged Cookie string is rebuilt per crumb, leaving stale copies in memory (~4,000:1).
IMPACT AND EXPOSURE: A home computer on a ~100 Mbps connection can render a vulnerable server inaccessible within seconds — demonstrated at ~32 GB consumed in ~10s (Envoy 1.37.2), ~18s (Apache httpd 2.4.67), ~45s (nginx 1.29.7), and ~64 GB in ~45s (Microsoft IIS on Windows Server 2025). Shodan analysis identified 880,000+ public-facing websites running HTTP/2 on one of these servers, though many sit behind CDNs that blunt direct exposure.
REMEDIATION STATUS: nginx fixed it in 1.29.8 with a new max_headers directive (default 1,000). Apache assigned CVE-2026-49975 and Stefan Eissing fixed it the same day (2026-05-27) by counting Cookie crumbs against LimitRequestFields; the fix ships in standalone mod_http2 v2.0.41 and httpd trunk but, as of disclosure, not yet in a 2.4.x release. Microsoft IIS, Envoy and Cloudflare Pingora had no patch available at publication. The durable defense is to enforce BOTH a header-field-count cap AND a decoded-size cap, bound the lifetime/memory of stalled streams, and constrain per-worker memory via cgroups/ulimit/container limits for graceful OOM restart. This is distinct from CVE-2026-23918 (Apache mod_http2 double-free, TL-2026-0475) — a different mechanism, no memory-exhaustion chain — and from the 2023 HTTP/2 Rapid Reset family.
Weaknesses (CWE)
CWE-400, CWE-770, CWE-409
Target sectors: technology, financial, government, healthcare, ecommerce, telecommunications, media, hosting
Target regions: Global
Detections & IOCs
As of 2026-07-20, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 14 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, HIGH, threat intelligence, cybersecurity, CVE-2026-49975, T1595, T1592, T1587, T1588, T1190, T1498, T1498, T1499, T1499, T1499