--- schema: 1 kind: vulnerability title: "HTTP/2 Bomb (CVE-2026-49975): a single-connection memory-exhaustion DoS against every major web server" headline: "HTTP/2 Bomb (CVE-2026-49975): a single-connection memory-exhaustion DoS against every major web server" summary: "HTTP/2 Bomb (CVE-2026-49975) exhausts a server's RAM from one connection in ~10 s — a composite of HPACK dynamic-table amplification plus Slowloris-style stream-holding that needs no authentication and works against default HTTP/2 configs. nginx (≥1.29.8) and Apache mod_http2 (v2.0.41) are patched; Microsoft IIS, Envoy and Cloudflare Pingora remained unpatched at disclosure, with a working write-up public (Calif/Codex, 2026-06-02)." discovered_at: "2026-06-04T05:00:13Z" event_date: 2026-06-03 run_id: 2026-06-04-51b23ffa priority: high immediate_action: null tags: - vulnerabilities - dos - poc-public - no-patch regions: - global sectors: - public-sector entities: [] cves: - id: CVE-2026-49975 cvss: n/a epss: null type: dos vector: zero-click auth: pre-auth status: - poc-public - patch-available - no-patch sources: - url: "https://blog.calif.io/p/codex-discovered-a-hidden-http2-bomb" publisher: Calif/Codex — HTTP/2 Bomb disclosure role: primary - url: "https://www.openwall.com/lists/oss-security/2026/06/03/3" publisher: oss-security mailing list role: corroborating - url: "https://thehackernews.com/2026/06/new-http2-bomb-vulnerability-allows.html" publisher: The Hacker News role: corroborating closed_sources: [] evidence: - quote: "The vulnerable behavior exists in each server's default HTTP/2 configuration" publisher: Calif/Codex - quote: "nginx: Upgrade to 1.29.8+, which adds the max_headers directive with a default of 1000." publisher: oss-security mailing list verification: multi-source sourcing_note: null confidence: high update_of: null references: [] deep_dive: true deep_dive_category: network-stack-rce org_triage: null watchlist_hit: false actions: [] migrated_from: briefs/2026-06-04.md --- The Codex research team (Calif) published HTTP/2 Bomb, assigned CVE-2026-49975, a remote denial-of-service that takes most major web servers offline from one connection in roughly ten seconds with no authentication and against their *default* HTTP/2 configuration ([Calif/Codex, 2026-06-02](https://blog.calif.io/p/codex-discovered-a-hidden-http2-bomb)). At disclosure the researcher counted 880,000+ public-facing servers with HTTP/2 enabled on affected software — a population that includes a large share of government web portals, citizen-facing services and reverse-proxy front ends. **Mechanics — two old primitives composed into one new amplifier.** The attack chains two separately documented HTTP/2 behaviours ([Calif/Codex, 2026-06-02](https://blog.calif.io/p/codex-discovered-a-hidden-http2-bomb)). First, *HPACK dynamic-table amplification*: the attacker seeds the server's header-compression table with one large entry, then references it thousands of times per request using single-byte back-references, forcing the server to reconstruct a large header set in memory for each reference. Second, *Slowloris-style stream holding*: the attacker keeps every allocated stream open indefinitely with a continuous trickle of `WINDOW_UPDATE` frames, so the reconstructed memory is never freed. Combined, a single residential connection drove an Envoy instance to exhaust about 32 GB of RAM in ~10 s. The root cause is structural: RFC 7541 §7.3 bounds dynamic-table *size* via `SETTINGS_HEADER_TABLE_SIZE` but never caps the *number* of references per request independently of total size, and per-stream memory lifetime is unbounded while `WINDOW_UPDATE` activity continues — so no in-spec setting alone closes the gap. **Affected and patched versions (vendor-stated).** nginx is fixed in **1.29.8**, which introduces a new `max_headers` directive defaulting to 1000; Apache httpd is fixed in **`mod_http2` v2.0.41**, shipped as a standalone module release and not yet folded into a 2.4.x release at disclosure ([oss-security, 2026-06-03](https://www.openwall.com/lists/oss-security/2026/06/03/3)). At initial disclosure Microsoft IIS, Envoy and Cloudflare Pingora had no patch; a 3 June update to the disclosure notes **Envoy has since shipped a fix (advisory GHSA-22m2-hvr2-xqc8), leaving Microsoft IIS and Cloudflare Pingora unpatched** ([Calif/Codex, 2026-06-02](https://blog.calif.io/p/codex-discovered-a-hidden-http2-bomb)). The disclosure was deliberately timed after nginx shipped its fix; the researcher released publicly — with mitigations — assessing that the nginx/Apache commit diffs could be turned into a working exploit quickly, so defenders needed the mitigation guidance immediately. **ATT&CK.** This is availability impact through a software-flaw resource-exhaustion path — [`T1499.004` Endpoint Denial of Service: Application or System Exploitation](https://attack.mitre.org/techniques/T1499/004/), reached over application-layer protocol abuse ([`T1071.001`](https://attack.mitre.org/techniques/T1071/001/)). **Hardening / mitigation, by stack.** nginx: upgrade to 1.29.8+ (the `max_headers` cap is the structural fix) or, as a stop-gap, set `http2 off;`. Apache: apply the `mod_http2` v2.0.41 standalone release, or set `Protocols http/1.1` as an interim — note that lowering `LimitRequestFields` is **not** effective here because the cookie-crumb references never count against it; only `LimitRequestFieldSize` reduces per-stream blast radius. Envoy: apply its 3 June fix (advisory GHSA-22m2-hvr2-xqc8). Microsoft IIS / Cloudflare Pingora (still no vendor patch): disable HTTP/2 at the edge where feasible, and apply per-worker memory limits (cgroups / `ulimit -v`) so a bombed worker is OOM-killed before it exhausts the host ([oss-security, 2026-06-03](https://www.openwall.com/lists/oss-security/2026/06/03/3)). **Hunt and detection concepts.** The traffic signature is unusual: a spike in short HTTP/2 requests from a single source IP that drives per-worker memory consumption sharply upward while the *connection count stays low* relative to the memory pressure — the inverse of a classic volumetric flood ([Calif/Codex, 2026-06-02](https://blog.calif.io/p/codex-discovered-a-hidden-http2-bomb)). Watch for streams kept alive by `WINDOW_UPDATE` frames with no accompanying `DATA` frames, and instrument per-worker RSS so an anomalous single-connection memory climb pages before the host OOMs. No IOCs are warranted — the indicator is the behaviour, not an address.