#threatreport #LowCompleteness Codex Discovered a Hidden HTTP/2 Bomb | 03-06-2026 Source: https://blog.calif.io/p/codex-discovered-a-hidden-http2-bomb Key details below ↓ 💀Threats: Slowloris_technique, 🎯Victims: Web servers, Apache httpd, Envoy, Nginx, Iis, Pingora 🏭Industry: Transport 🔓CVEs: CVE-2026-49975 \[[Vulners](https://vulners.com/cve/CVE-2026-49975)] - CVSS V3.1: *Unknown*, - Vulners: Exploitation: Unknown CVE-2016-8740 \[[Vulners](https://vulners.com/cve/CVE-2016-8740)] - CVSS V3.1: *Unknown*, - Vulners: Exploitation: Unknown CVE-2016-1546 \[[Vulners](https://vulners.com/cve/CVE-2016-1546)] - CVSS V3.1: *Unknown*, - Vulners: Exploitation: Unknown CVE-2016-6581 \[[Vulners](https://vulners.com/cve/CVE-2016-6581)] - CVSS V3.1: *Unknown*, - Vulners: Exploitation: Unknown CVE-2025-53020 \[[Vulners](https://vulners.com/cve/CVE-2025-53020)] - CVSS V3.1: *Unknown*, - Vulners: Exploitation: Unknown 🤖LLM extracted TTPs:` T1499.002, T1499.003, T1499.004 💽Software: nginx, Docker #threatreport: The recently uncovered HTTP/2 Bomb is a sophisticated remote denial-of-service (DoS) exploit targeting numerous widely used web servers. This attack exploits the HTTP/2 protocol's header compression scheme known as HPACK. By combining techniques from previous vulnerabilities, specifically using a compression bomb and a Slowloris-style hold, the attack is capable of overwhelming servers rapidly. The HPACK Bomb portion of the exploit involves seeding the dynamic table with a single header and then broadcast thousands of 1-byte indexed references to it. For attackers, this operation costs only one byte on the wire, but the server incurs considerable allocation costs ranging from approximately 70 bytes for nginx and IIS to nearly 4,000 bytes for servers like Apache httpd and Envoy. The second component, HTTP/2 Window Stall, involves setting a zero-byte flow-control window, preventing the server from completing its response. Concurrently, the attacker sends 1-byte WINDOW_UPDATE frames to continually reset the send timeout, thereby holding memory allocations for as long as the server's settings allow. Previous iterations of these techniques are documented, such as the HPACK Bomb concept introduced by Cory Benfield in 2016 and related HTTP/2 Slowloris type exhaustion vulnerabilities like CVE-2016-8740 and CVE-2016-1546. However, the recent implementation in the HTTP/2 Bomb provides a more potent amplification effect. For servers that limit header-field counts, the exploit can bypass these checks by exploiting the Cookie header, which can be split, allowing significant amplification ratios. For instance, on Envoy, a substantial cookie can yield a ratio of roughly 3,800:1 in allowed logical cookie bytes versus the bytes sent over the network, with Apache httpd’s handling even leading to approximations of 4,000:1. Disclosure efforts regarding this vulnerability were made to nginx and Apache, with nginx responding quickly to patch the issue. Apache's subsequent patch modified how cookie headers are managed regarding limits, leading to the assignment of CVE-2026-49975.
Post summary
The report discloses a new HTTP/2 Denial‑of‑Service vulnerability (CVE‑2026‑49975), details its exploitation mechanics, and notes that patches have been released for nginx and Apache.