CERT24New HTTP/2 Bomb Vulnerability Enables Remote DoS Against Web ServersLoading data…
CERT24Threat Observatory
Period

New HTTP/2 Bomb Vulnerability Enables Remote DoS Against Web Servers

The HTTP/2 Bomb vulnerability described by Calif is a remotely triggered denial-of-service attack affecting NGINX, Apache HTTPD, Microsoft IIS, Envoy, and Cloudflare Pingora. The attack abuses memory allocation for HPACK headers together with HTTP/2 flow control to keep allocated server memory from being released.

← Back to intelligence

New HTTP/2 Bomb Vulnerability Enables Remote DoS Against Web Servers

The HTTP/2 Bomb vulnerability described by Calif is a remotely triggered denial-of-service attack affecting NGINX, Apache HTTPD, Microsoft IIS, Envoy, and Cloudflare Pingora. The attack abuses memory allocation for HPACK headers together with HTTP/2 flow control to keep allocated server memory from being released.