#Microsoft IIS

HTTP/2 Bomb: A Decade-Old Compression Trick Finally Gets a CVE

A chained HPACK attack lets small packets force runaway memory allocation on nginx, Apache, IIS, Envoy, and Cloudflare's Pingora. Patches are partial. Exposure is wide.