# HTTP/2 Bomb — Remote DoS via HPACK Indexed-Reference Compression Bomb + Zero-Window Flow-Control Hold Affecting nginx, Apache httpd, IIS, Envoy & Cloudflare Pingora (CVE-2026-49975, Public PoC)

> HTTP/2 Bomb is a remote, unauthenticated denial-of-service technique that chains an HPACK (RFC 7541) dynamic-table indexed-reference compression bomb with a Slowloris-style zero-window HTTP/2 flow-control hold (RFC 9113) to exhaust tens of gigabytes of server memory from a single low-bandwidth connection. A single client can consume and pin ~32 GB on Apache httpd or Envoy in under 20 seconds. Discovered by Quang Luong (using OpenAI Codex) and affecting the default HTTP/2 configurations of nginx, Apache httpd, Microsoft IIS, Envoy and Cloudflare Pingora; the Apache variant is tracked as CVE-2026-49975. Public PoCs, Docker labs and per-server write-ups are published.

- **Published:** 2026-06-03T00:00:00Z
- **Last reviewed:** 2026-06-03T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0668
- **ID:** TL-2026-0668
- **Severity:** HIGH (CVSS 7.5)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 14 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-49975

## Description

HTTP/2 Bomb is a memory-exhaustion denial-of-service technique against the default HTTP/2 stacks of the most widely deployed web servers and reverse proxies. It composes two individually known primitives into a single highly effective request, and was surfaced when researcher Quang Luong used OpenAI Codex to explore HTTP/2 attack surface; Jun Rong and Duc Phan confirmed cross-server exploitability.

PRIMITIVE 1 — HPACK Indexed-Reference Compression Bomb (RFC 7541): HTTP/2 uses HPACK stateful header compression. A client inserts one header into the connection's dynamic table, then emits thousands of 1-byte indexed references to that entry inside a single HEADERS frame. On every reference the receiver looks up the index and materializes a fresh full copy of the header field into the request it is assembling. Each reference costs the attacker exactly one byte on the wire but forces the server to allocate from ~70 bytes (nginx, IIS, Pingora) up to ~4,000 bytes (Apache httpd, Envoy) per reference, yielding wire-to-memory amplification ratios from ~62:1 to ~5,700:1.

PRIMITIVE 2 — Zero-Window Flow-Control Hold (RFC 9113): Standard amplification is transient because the server frees the buffers once it finishes the response. The attacker defeats this by advertising a zero-byte HTTP/2 flow-control window (SETTINGS_INITIAL_WINDOW_SIZE = 0 and/or a zero per-stream window), so the server can never transmit and free its response. A slow drip of 1-byte WINDOW_UPDATE frames continually resets the server's send/idle timeout, pinning every allocation in place indefinitely. This converts a one-shot amplification into a persistent, accumulating memory hold across many parallel streams on one connection.

HEADER-COUNT-CAP BYPASS (Cookie crumbs, RFC 9113 §8.2.3): Servers that defend by capping the NUMBER of header fields rather than the decoded SIZE (Apache httpd, Envoy) are bypassed using the Cookie header. RFC 9113 §8.2.3 permits splitting a Cookie header into many individual 'crumb' fields for better compression; vulnerable servers did not count these crumbs against their field-count limit (e.g. Apache's LimitRequestFields). On Envoy each crumb is appended to a growing buffer (~3,600:1 logical, ~5,700:1 measured); on Apache httpd the merged Cookie string is rebuilt per crumb, leaving stale copies in memory (~4,000:1).

IMPACT AND EXPOSURE: A home computer on a ~100 Mbps connection can render a vulnerable server inaccessible within seconds — demonstrated at ~32 GB consumed in ~10s (Envoy 1.37.2), ~18s (Apache httpd 2.4.67), ~45s (nginx 1.29.7), and ~64 GB in ~45s (Microsoft IIS on Windows Server 2025). Shodan analysis identified 880,000+ public-facing websites running HTTP/2 on one of these servers, though many sit behind CDNs that blunt direct exposure.

REMEDIATION STATUS: nginx fixed it in 1.29.8 with a new max_headers directive (default 1,000). Apache assigned CVE-2026-49975 and Stefan Eissing fixed it the same day (2026-05-27) by counting Cookie crumbs against LimitRequestFields; the fix ships in standalone mod_http2 v2.0.41 and httpd trunk but, as of disclosure, not yet in a 2.4.x release. Microsoft IIS, Envoy and Cloudflare Pingora had no patch available at publication. The durable defense is to enforce BOTH a header-field-count cap AND a decoded-size cap, bound the lifetime/memory of stalled streams, and constrain per-worker memory via cgroups/ulimit/container limits for graceful OOM restart. This is distinct from CVE-2026-23918 (Apache mod_http2 double-free, TL-2026-0475) — a different mechanism, no memory-exhaustion chain — and from the 2023 HTTP/2 Rapid Reset family.

## MITRE ATT&CK

- T1595 Active Scanning
- T1592 Gather Victim Host Information
- T1587 Develop Capabilities
- T1588 Obtain Capabilities
- T1190 Exploit Public-Facing Application
- T1498 Network Denial of Service
- T1499 Endpoint Denial of Service
- T1496 Resource Hijacking

## Sources

- [Codex Discovered a Hidden HTTP/2 Bomb (researcher write-up)](https://blog.calif.io/p/codex-discovered-a-hidden-http2-bomb)
- [HTTP/2 Bomb — Remote DoS Exploit Hits nginx, Apache, IIS, Envoy, and Cloudflare Pingora](https://cybersecuritynews.com/http-2-bomb-remote-dos-exploit/)
- [New HTTP/2 DoS attack can crash web servers with a single connection](https://www.bleepingcomputer.com/news/security/new-http-2-dos-attack-can-crash-web-servers-with-a-single-connection/)
- [HTTP/2 Bomb PoCs, Docker labs and per-server write-ups](https://github.com/califio/publications/tree/main/MADBugs/http2-bomb)
- [Apache HTTP Server 2.4 vulnerabilities (CVE listing)](https://httpd.apache.org/security/vulnerabilities_24.html)
- [RFC 7541 — HPACK: Header Compression for HTTP/2](https://www.rfc-editor.org/rfc/rfc7541)
- [RFC 9113 — HTTP/2 (flow control §5.2, Cookie §8.2.3)](https://www.rfc-editor.org/rfc/rfc9113)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0668