HTTP/2 Bomb — Remote DoS via HPACK Indexed-Reference Compression Bomb + Zero-Window Flow-Control Hold Affecting nginx, Apache httpd, IIS, Envoy & Cloudflare Pingora (CVE-2026-49975, Public PoC)

HTTP/2 Bomb — Remote DoS via HPACK Indexed-Reference (TL-2026-0668), also tracked as HTTP/2 Bomb, is a high-severity software vulnerability scored CVSS 7.5, first published 2026-06-03. It has no confirmed attribution, affects F5 / nginx nginx, references 1 CVE (CVE-2026-49975), maps to 8 MITRE ATT&CK techniques (T1190, T1496, T1498), and is covered by 9 detection rules and 14 indicators of compromise.

Key facts for TL-2026-0668

Threat ID
TL-2026-0668
Also known as
HTTP/2 Bomb, HPACK Indexed-Reference Bomb, HTTP/2 Window Stall Bomb
Severity
HIGH
CVSS
7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-06-03
Last reviewed
2026-06-03
Attribution confidence
NONE
Motivation
UNKNOWN
Target sectors
technology, financial, government, healthcare, ecommerce, telecommunications, media, hosting
Target regions
Global
Detection rules
9
Indicators of compromise
14

Malware and tooling in HTTP/2 Bomb — Remote DoS via HPACK Indexed-Reference

Malware and tooling: http2-bomb PoC (per-server scripts: envoy, httpd, nginx, microsoft-iis, pingora)

HTTP/2 Bomb is a remote, unauthenticated denial-of-service technique that chains an HPACK (RFC 7541) dynamic-table indexed-reference compression bomb with a Slowloris-style zero-window HTTP/2 flow-control hold (RFC 9113) to exhaust tens of gigabytes of server memory from a single low-bandwidth connection. A single client can consume and pin ~32 GB on Apache httpd or Envoy in under 20 seconds. Discovered by Quang Luong (using OpenAI Codex) and affecting the default HTTP/2 configurations of nginx, Apache httpd, Microsoft IIS, Envoy and Cloudflare Pingora; the Apache variant is tracked as CVE-2026-49975. Public PoCs, Docker labs and per-server write-ups are published.

How HTTP/2 Bomb — Remote DoS via HPACK Indexed-Reference works

HTTP/2 Bomb is a memory-exhaustion denial-of-service technique against the default HTTP/2 stacks of the most widely deployed web servers and reverse proxies. It composes two individually known primitives into a single highly effective request, and was surfaced when researcher Quang Luong used OpenAI Codex to explore HTTP/2 attack surface; Jun Rong and Duc Phan confirmed cross-server exploitability.

PRIMITIVE 1 — HPACK Indexed-Reference Compression Bomb (RFC 7541): HTTP/2 uses HPACK stateful header compression. A client inserts one header into the connection's dynamic table, then emits thousands of 1-byte indexed references to that entry inside a single HEADERS frame. On every reference the receiver looks up the index and materializes a fresh full copy of the header field into the request it is assembling. Each reference costs the attacker exactly one byte on the wire but forces the server to allocate from ~70 bytes (nginx, IIS, Pingora) up to ~4,000 bytes (Apache httpd, Envoy) per reference, yielding wire-to-memory amplification ratios from ~62:1 to ~5,700:1.

PRIMITIVE 2 — Zero-Window Flow-Control Hold (RFC 9113): Standard amplification is transient because the server frees the buffers once it finishes the response. The attacker defeats this by advertising a zero-byte HTTP/2 flow-control window (SETTINGS_INITIAL_WINDOW_SIZE = 0 and/or a zero per-stream window), so the server can never transmit and free its response. A slow drip of 1-byte WINDOW_UPDATE frames continually resets the server's send/idle timeout, pinning every allocation in place indefinitely. This converts a one-shot amplification into a persistent, accumulating memory hold across many parallel streams on one connection.

HEADER-COUNT-CAP BYPASS (Cookie crumbs, RFC 9113 §8.2.3): Servers that defend by capping the NUMBER of header fields rather than the decoded SIZE (Apache httpd, Envoy) are bypassed using the Cookie header. RFC 9113 §8.2.3 permits splitting a Cookie header into many individual 'crumb' fields for better compression; vulnerable servers did not count these crumbs against their field-count limit (e.g. Apache's LimitRequestFields). On Envoy each crumb is appended to a growing buffer (~3,600:1 logical, ~5,700:1 measured); on Apache httpd the merged Cookie string is rebuilt per crumb, leaving stale copies in memory (~4,000:1).

IMPACT AND EXPOSURE: A home computer on a ~100 Mbps connection can render a vulnerable server inaccessible within seconds — demonstrated at ~32 GB consumed in ~10s (Envoy 1.37.2), ~18s (Apache httpd 2.4.67), ~45s (nginx 1.29.7), and ~64 GB in ~45s (Microsoft IIS on Windows Server 2025). Shodan analysis identified 880,000+ public-facing websites running HTTP/2 on one of these servers, though many sit behind CDNs that blunt direct exposure.

REMEDIATION STATUS: nginx fixed it in 1.29.8 with a new max_headers directive (default 1,000). Apache assigned CVE-2026-49975 and Stefan Eissing fixed it the same day (2026-05-27) by counting Cookie crumbs against LimitRequestFields; the fix ships in standalone mod_http2 v2.0.41 and httpd trunk but, as of disclosure, not yet in a 2.4.x release. Microsoft IIS, Envoy and Cloudflare Pingora had no patch available at publication. The durable defense is to enforce BOTH a header-field-count cap AND a decoded-size cap, bound the lifetime/memory of stalled streams, and constrain per-worker memory via cgroups/ulimit/container limits for graceful OOM restart. This is distinct from CVE-2026-23918 (Apache mod_http2 double-free, TL-2026-0475) — a different mechanism, no memory-exhaustion chain — and from the 2023 HTTP/2 Rapid Reset family.

MITRE ATT&CK techniques used in TL-2026-0668

Initial Access

T1190 Exploit Public-Facing Application

Impact

T1496 Resource Hijacking; T1498 Network Denial of Service; T1499 Endpoint Denial of Service

Resource Development

T1587 Develop Capabilities; T1588 Obtain Capabilities

Reconnaissance

T1592 Gather Victim Host Information; T1595 Active Scanning

Affected products and versions in HTTP/2 Bomb — Remote DoS via HPACK Indexed-Reference

  • F5 / nginx — nginx
    Vulnerable versions: <= 1.29.7
    Fixed in: 1.29.8 (adds max_headers, default 1000)
  • Apache Software Foundation — Apache httpd (mod_http2)
    Vulnerable versions: 2.4.67 and earlier 2.4.x with mod_http2
    Fixed in: mod_http2 v2.0.41 (standalone) / httpd trunk; no 2.4.x release at disclosure
  • Microsoft — Internet Information Services (IIS)
    Vulnerable versions: Windows Server 2025
    Fixed in: No patch at disclosure
  • Envoy Project / CNCF — Envoy
    Vulnerable versions: 1.37.2
    Fixed in: No patch at disclosure
  • Cloudflare — Pingora
    Vulnerable versions: 0.8.0
    Fixed in: No patch at disclosure

Remediation for HTTP/2 Bomb — Remote DoS via HPACK Indexed-Reference

Patches

  • nginx: upgrade to 1.29.8 or later and configure the 'max_headers' directive (default 1,000).
  • Apache httpd: apply mod_http2 v2.0.41 (standalone) or httpd trunk fix for CVE-2026-49975; no 2.4.x release at disclosure — disable HTTP/2 in the interim.
  • Cloudflare Pingora / Envoy / Microsoft IIS: no vendor patch available at time of disclosure — apply memory-limit and HTTP/2-disable workarounds and track vendor advisories.

Immediate actions

  • If you cannot upgrade, disable HTTP/2 (Apache: 'Protocols http/1.1'; nginx: remove 'http2' from listen directives) to remove the attack surface entirely.
  • Cap per-worker/per-process memory via cgroups, 'ulimit -v', or container memory limits so an attack triggers a graceful OOM restart instead of host exhaustion.
  • Front origin servers with a CDN/WAF that terminates and normalizes HTTP/2 and enforces strict header and flow-control limits.
  • Monitor for single connections opening many streams with zero-window holds and drip WINDOW_UPDATE frames; rate-limit or drop offending connections.

Workarounds

  • Disable HTTP/2, falling back to HTTP/1.1.
  • Apply per-process memory ceilings (cgroups v2 memory.max, ulimit -v, Docker --memory).
  • Lower HTTP/2 max concurrent streams and header table size where configurable.

Longer-term hardening

  • Enforce BOTH a header-field-count cap AND a decoded-header-size cap — decoded size alone fails against the indexed-reference variant and field-count alone fails against the Cookie-crumb bypass.
  • Bound the lifetime and buffered memory of stalled/zero-window HTTP/2 streams; reclaim memory on flow-control stalls rather than pinning indefinitely.
  • Count Cookie 'crumb' fields (RFC 9113 §8.2.3) against header-field limits.
  • Deploy memory-pressure alerting and automated restart for web tiers.

CVEs associated with HTTP/2 Bomb — Remote DoS via HPACK Indexed-Reference

CVE-2026-49975

Weaknesses (CWE) in HTTP/2 Bomb — Remote DoS via HPACK Indexed-Reference

CWE-400, CWE-770, CWE-409

Timeline of HTTP/2 Bomb — Remote DoS via HPACK Indexed-Reference

  • HTTP/2 Bomb HPACK indexed-reference + zero-window technique reported to nginx (F5) maintainers (April 2026).
  • Cloudflare Pingora 0.8.0 variant (tiny 'a:' header, ~62:1) reported to Cloudflare (May 2026).
  • Fix landed in standalone mod_http2 v2.0.41 and httpd trunk; no 2.4.x point release available at disclosure.
  • Apache httpd mod_http2 variant disclosed; CVE-2026-49975 assigned and Stefan Eissing committed a same-day fix counting Cookie crumbs against LimitRequestFields.
  • Shodan analysis identifies 880,000+ public-facing HTTP/2 sites running affected servers; nginx fix shipped in 1.29.8 with new max_headers directive (default 1,000).
  • Public disclosure via calif.io research write-up plus media coverage; PoC scripts, Docker labs and per-server write-ups published to GitHub (califio/publications, MADBugs/http2-bomb).
  • Technique scheduled for presentation by Quang Luong at the Real World AI Security conference, Stanford (June 2026).

Sources cited for HTTP/2 Bomb — Remote DoS via HPACK Indexed-Reference

Threats related to HTTP/2 Bomb — Remote DoS via HPACK Indexed-Reference

Detection coverage for TL-2026-0668

As of 2026-06-03, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0668 across Splunk SPL, Microsoft KQL and Sigma, covering 14 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats