New HTTP/2 Bomb Vulnerability Allows Remote DoS on NGINX, Apache, IIS, Envoy & Cloudflare

Summary: Researchers at Calif discovered a remote denial-of-service exploit codenamed HTTP/2 Bomb affecting NGINX, Apache HTTPD, Microsoft IIS, Envoy, and Cloudflare Pingora, present in each server's default HTTP/2 configuration and found using OpenAI Codex by chaining an HPACK compression bomb with a zero-byte flow-control window hold. A single client can consume and hold 32GB of server memory against Apache HTTPD and Envoy in about 20 seconds, and a home computer on a 100Mbps connection could render a vulnerable server inaccessible within seconds.
What's compelling: The flaw is tracked as CVE-2026-47774 with a CVSS score of 7.5, and Microsoft IIS and Envoy had no patch available as of writing, while Microsoft addressed its CVE-2026-49160 (CVSS 7.8) in June 2026 Patch Tuesday updates. The decoded-size limit that servers learned to enforce never fires here, because the header is nearly empty and the amplification comes from per-entry bookkeeping the server allocates around it.

Read the original at The Hacker News ↗

Topics: Threat Actors & Nation-State
Mentions: CVE-2016-1546 CVE-2016-6581 CVE-2016-8740 CVE-2025-53020 CVE-2026-47774 CVE-2026-49160
Related: Microsoft Patches Record 206 Flaws, Including Three Zero-Days and Critical RCE Bugs Cyber Risks ·
A Record-Breaking Patch Tuesday for June 2026 Cyber Risks ·
University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026