HTTP/2 Bomb: A Decade-Old Compression Trick Finally Gets a CVE

A vulnerability in how HTTP/2 servers handle header compression can be weaponized to exhaust server memory through a relatively tiny stream of attacker-controlled traffic. Security consultancy Calif disclosed the flaw, tracked as CVE-2026-49975, after identifying it through Codex-assisted code analysis — analysis the firm says surfaced a pattern that over a decade of human review missed.

The attack targets HPACK, the header compression scheme defined for HTTP/2. HPACK uses a dynamic table to avoid retransmitting repeated headers. Calif found that an attacker can manipulate this table to force servers into repeated, outsized memory allocations far exceeding the apparent size of the incoming request. One byte of wire traffic, the firm's CEO Thai Duong wrote, can produce one full header allocation on the server — repeated thousands of times per request.

The hold is the second half of the chain. A zero-byte flow-control window prevents the server from freeing any of that allocated memory, keeping resources locked until the session terminates. Duong described the combined technique as an "HTTP/2 Bomb" — a compression bomb fused with a Slowloris-style connection hold.

Exposure is not narrow. A Shodan query Duong cited returned more than 880,000 websites running HTTP/2 on an affected server. CDN placement may complicate exploitation in some cases, but it does not eliminate the attack surface.

This is the third significant HTTP/2 denial-of-service disclosure in roughly six years. Netflix disclosed a batch of HTTP/2 DoS vulnerabilities in 2019, prompting emergency patches across the ecosystem. October 2023 brought disclosure of stream-multiplexing abuse enabling massive DDoS. Each disclosure arrived via the same protocol, and each time the compression and flow-control machinery yielded new attack geometry.

Calif notified all affected vendors. nginx released a fix in v1.29.8. Apache addressed the issue in mod_http2 v2.0.41. Envoy patched across four release branches — 1.35.11, 1.36.7, 1.37.3, and 1.38.1 — on June 3. At time of publication, Microsoft IIS and Cloudflare's Pingora had not released patches.

For organizations without a patch available, Calif recommended two mitigations: disable HTTP/2 entirely where operationally feasible, or front the exposed server with a proxy that enforces a hard cap on header count per request.

Administrators running nginx or Apache should update through standard distribution channels. Those running Envoy should confirm they are on one of the four patched branches. IIS and Pingora operators are waiting.