HTTP/2 Default Configs Leave Web Servers Open to Compression-Bomb, Slowloris Combo Attack
A chained exploit targeting HTTP/2's default settings can take servers offline in seconds — no patch issued yet for the underlying configuration exposure.
The attack is deceptively simple. Researchers have identified an exploit chain that pairs a compression bomb with a Slowloris-style connection hold against HTTP/2's default configuration, knocking targeted web servers offline rapidly.
Compression bombs are not new. Neither is Slowloris. What matters here is the combination — weaponizing HTTP/2's built-in header compression (HPACK) alongside slow, deliberate connection exhaustion to produce an effect greater than either technique achieves alone.
Major web servers running default HTTP/2 settings carry the exposure. That qualifier — default — is doing real work in this disclosure. It suggests the attack surface is wide. Hardened or explicitly tuned deployments may reduce exposure, but most production environments don't stray far from defaults.
The mechanic worth understanding: HTTP/2 multiplexes multiple streams over a single TCP connection, which is precisely the feature that makes the Slowloris component effective here. An attacker holds that connection open while simultaneously detonating compressed payloads that expand to consume server memory. The server struggles to recover. Availability collapses.
This is a denial-of-service primitive, not an intrusion vector. Capability and intent are different things. Nothing in the reported behavior suggests remote code execution or data exfiltration is achievable through this chain. The threat model is disruption — targeted downtime against services that haven't tuned HTTP/2 timeout and stream-limit parameters.
For defenders, the immediate mitigations are configuration-level: tighten stream concurrency limits, enforce aggressive header-size caps, and reduce idle connection timeouts on HTTP/2 listeners. Neither of these requires waiting on a vendor patch cycle.
No CVE assignment has been publicly confirmed for this specific chain at time of writing. That may change as server vendors assess whether the behavior constitutes a patchable flaw or an operator misconfiguration problem — a distinction vendors have historically debated at length with DoS research.
