HTTP/2 Bomb: A Decade-Old Compression Trick Finally Gets a CVE

Key points

• CVE-2026-49975 lets an attacker exhaust server memory by chaining HPACK compression abuse with a zero-byte flow-control hold.
• Nginx, Apache and Envoy have patches; Microsoft IIS and Cloudflare's Pingora had not released fixes at publication.
• A Shodan query cited by Calif returned more than 880,000 websites running HTTP/2 on an affected server.
• CDN placement adds complexity but doesn't eliminate the attack surface.
• Where no patch exists, Calif recommends disabling HTTP/2 or fronting the server with a proxy that caps header count per request.

Security consultancy Calif disclosed CVE-2026-49975, a vulnerability in how HTTP/2 servers handle header compression, after Codex-assisted code analysis surfaced a pattern that over a decade of human review had missed. We broke the initial disclosure on 3 June in "HTTP/2 Bomb: Default Configs in NGINX, Apache, IIS, Envoy and Pingora Open Door to Remote DoS"; this story covers the patch status now that CVEs are assigned.

How does the attack work?

The flaw targets HPACK, the header compression scheme built into HTTP/2. HPACK maintains a dynamic table to avoid retransmitting repeated headers. Calif found that an attacker can manipulate this table to force repeated, outsized memory allocations far beyond what the incoming traffic appears to justify. One byte on the wire, Calif CEO Thai Duong wrote in a blog post, becomes one full header allocation on the server, repeated thousands of times per request.

The second half of the chain holds those allocations in place. A zero-byte flow-control window stops the server from freeing memory until the session ends. Duong called the combined technique an "HTTP/2 Bomb": a compression bomb fused with a Slowloris-style hold.

Duong also noted that he contributed to patching a 2012 HPACK flaw exploited by a different attack, CRIME. "I was too fixated on fighting CRIME and missed the Bomb," he wrote.

Should you worry?

HTTP/2 DoS disclosures aren't new. Netflix surfaced a batch in 2019 that forced emergency patches across the ecosystem, and October 2023 brought disclosure of stream-multiplexing abuse enabling massive DDoS. Each time, the protocol's compression and flow-control machinery yielded fresh attack geometry. This one arrives with a CVE and working vendor patches for three of five affected implementations, which is further along than either predecessor at initial disclosure.

Exposure is broad. Shodan returned more than 880,000 affected sites at the time Duong published.

What should administrators do?

Nginx patched in v1.29.8. Apache addressed the issue in mod_http2 v2.0.41. Envoy patched across four branches on 3 June: 1.35.11, 1.36.7, 1.37.3 and 1.38.1. IIS and Pingora operators are still waiting.

For those without a patch, Calif's guidance is to disable HTTP/2 where operationally feasible, or front the exposed server with a proxy that enforces a hard cap on header count per request. The second option is the more realistic one for production environments where HTTP/2 is load-bearing.