CVE‑2026‑49975, known as "HTTP/2 Bomb," is a Denial of Service (DoS) vulnerability that leads to severe server overload during
HTTP/2 request processing. Attackers can exploit the intersection of HPACK header compression and HTTP/2 flow control to trigger
massive memory expansion with minimal network traffic.
If successfully exploited, this vulnerability can cause a rapid spike in memory and CPU utilization, connection hangs,
response delays, and ultimately, service disruption for legitimate users. Organizations operating HTTP/2‑enabled web servers,
API gateways, or reverse proxies should immediately assess their exposure, apply relevant patches, and review security configurations.
From a threat intelligence perspective, this vulnerability is particularly notable because it demonstrates how AI‑assisted code
analysis can identify complex, protocol‑level weaknesses—signaling a shift toward more automated vulnerability research and advanced
attack variants in the future.
resource consumption during HTTP/2 request processing. An attacker can exploit it by precisely combining HTTP/2’s HPACK header
compression algorithm with its flow control characteristics, triggering memory expansion loads of tens of gigabytes on the target
server with relatively little network traffic. If the attack succeeds, the web server’s memory and CPU usage can spike sharply,
connections may become hung, and this can lead to response delays, service instability, and access failures for legitimate users.
Accordingly, environments such as web servers, API servers, and reverse proxies with HTTP/2 enabled should assess whether their
infrastructure is affected and perform the relevant patching and configuration checks. In particular, this vulnerability has also
been identified through the use of AI‑based automated code analysis tools, making it a matter of strong concern from a threat intelligence
perspective as it demonstrates the potential for future automated vulnerability discovery and more advanced variant attack techniques.
Key Summary
Unlike a conventional DDoS attack that generates massive traffic, HTTP/2 Bomb is an asymmetric denial‑of‑service (DoS) attack that
can rapidly exhaust a vulnerable server’s resources with relatively little bandwidth and a small number of requests.
By precisely combining HTTP/2’s HPACK header compression processing algorithm (internal resource management logic) with its flow
control characteristics, the attacker sharply increases the server’s memory and CPU usage while keeping connections in a hung state,
causing response delays or service outages.
According to the latest security advisories, potential impact has been reported in the default HTTP/2 configurations of major web servers
such as Nginx, Apache HTTP Server, Microsoft IIS, Envoy, and Cloudflare Pingora, and prompt security patching and configuration review
are strongly recommended for related products.
The attacker sends manipulated requests to a server with HTTP/2 enabled, causing the server to internally process far more data than
it actually receives on the network.
During this process, the server performs bookkeeping logic to decompress HPACK headers and update its internal dynamic table,
retaining data in memory in a disproportionately large amount relative to the actual payload size and thereby incurring heavy load.
In addition, because the attacker can constrain the window size to zero through flow control characteristics such as a 0‑byte
window update, the server may be unable to send response data and becomes stuck in memory, allowing data to accumulate without
being released and causing memory and CPU usage to rise rapidly.
Ultimately, HTTP/2 Bomb is an attack method that forces resource exhaustion by combining normal protocol features, and
its essence lies in the asymmetry by which a small number of requests can cause massive disruption.
The main causes can be summarized as follows:
- Increased server memory usage during HPACK header decompression.
- Data is not immediately released and remains retained due to flow control characteristics.
- An asymmetric processing structure where small requests lead to large resource consumption.
- An attack surface exposed through external requests in HTTP/2‑enabled environments.
3. Detailed Analysis
HTTP/2 Bomb does not exploit a single vulnerable component alone; rather, it is an attack chain that uses both HTTP/2’s header
compression algorithm and flow control characteristics together. During HPACK header compression processing, the attacker induces
the server to handle a small input as a much larger internal data structure, causing the server to use more memory than the actual data
it received. If HTTP/2 flow control then prevents the server from immediately releasing the data being processed, memory allocations
related to queued data may accumulate internally. As this process repeats, CPU and memory usage can rise rapidly, eventually leading to
response delays or service disruption.
According to publicly available vulnerability analysis materials, this technique can exhaust server resources even with relatively
low bandwidth, and in some environments service outages may occur within a short period of time.
Resource Exhaustion Flow
1. Start of HTTP/2 request processing
The attacker sends a manipulated request to a server with HTTP/2 enabled.
The server begins processing it as a normal HTTP/2 request.
2. HPACK header decompression
The server decompresses the received header data using the HPACK method.
This process can generate internal processing data larger than the data actually received.
3. Data retention due to flow control
Due to HTTP/2 flow control characteristics, some data may not be immediately processed or released.
As a result, processing backlog data can accumulate in the server’s internal buffers or memory.
4. Increase in resource usage
As the process repeats, the server’s CPU and memory usage rise rapidly.
Consequently, response delays, service instability, and web server process failures may occur.
The key point of this vulnerability is that the processing burden incurred inside the server is greater than the size of the request itself.
Therefore, anomaly detection methods based only on traffic volume or request size may find it difficult to identify suspicious behavior.
and memory usage. Unlike a conventional high-volume DDoS attack, this vulnerability abuses resource consumption that occurs during HTTP/2
request processing, so in vulnerable environments it can lead to degraded service quality or outages within a short time.
In particular, organizations should first assess whether environments such as HTTP/2-enabled web servers, API servers, reverse proxies, and
CDN-integrated systems are affected. In systems where real-time responsiveness is critical, such as consumer-facing services, finance, e-commerce,
and cloud services, response delays, connection instability, and service interruptions can lead to revenue loss and reduced customer trust.
In addition, this vulnerability does not simply involve traffic spikes; it increases the server’s internal processing burden by combining
normal HTTP/2 functions. Therefore, detection methods based only on request size or traffic volume may struggle to identify anomalies, and
administrators should also review the web server version, patch status, HTTP/2 configuration, and connection limiting policies.
It is also noteworthy that this case was identified using AI-based automated tools. Since similar protocol-abuse techniques may be discovered
in the future, it is necessary to reexamine not only patch application but also HTTP/2 operating policies and resource-limiting settings.
API gateways that support HTTP/2. Reviewing vendor advisories and applying the latest security updates is the highest-priority action.
Response Measures by Web Server
Web firewall-based measures
On a web firewall, HTTP/2 Bomb is difficult to detect using simple string-based signature patterns alone.
This attack does not rely on a specific URI or a fixed malicious payload; instead, it causes server resource exhaustion by combining
HTTP/2’s HPACK header compression algorithm with its flow control characteristics.
Therefore, it is appropriate to configure the web firewall with behavior-based detection at the session and stream levels.
Suspicious behavior can be identified when the number of headers in a single request or stream increases excessively,
when repeated HEADERS frames occur within the same session, when Cookie headers arrive split into many fragments, or
when long-lived HTTP/2 connections are accompanied by increased server CPU or memory usage.
However, if traffic is blocked immediately based only on the number of headers or the duration of a connection, legitimate services
may be affected. For that reason, it is necessary to begin in detection mode and establish a baseline of normal traffic. After that,
connection termination, request limiting, rate limiting, and temporary blocking policies should be applied gradually to anomalous
sessions that are repeatedly observed.
In conclusion, responding to this vulnerability requires behavior-based detection that comprehensively analyzes factors such as
header count, stream state, connection duration, and server resource usage, rather than relying solely on simple signature-based blocking.
HTTP/2’s HPACK header compression algorithm with its flow control characteristics. Even a relatively small number of requests can increase CPU
and memory usage on vulnerable servers, so affected web servers and reverse proxy environments with HTTP/2 enabled should be prioritized
for impact assessment.
To respond effectively, organizations should first promptly apply security patches from major vendors, review HTTP/2 protocol operating
settings, and strengthen limits on connections, headers, and stream thresholds. In addition, since simple signature-based detection has
limitations, behavior-based detection that correlates sessions and streams should also be deployed in web firewall and proxy layers.
HTTP/2 request processing. Attackers can exploit the intersection of HPACK header compression and HTTP/2 flow control to trigger
massive memory expansion with minimal network traffic.
If successfully exploited, this vulnerability can cause a rapid spike in memory and CPU utilization, connection hangs,
response delays, and ultimately, service disruption for legitimate users. Organizations operating HTTP/2‑enabled web servers,
API gateways, or reverse proxies should immediately assess their exposure, apply relevant patches, and review security configurations.
From a threat intelligence perspective, this vulnerability is particularly notable because it demonstrates how AI‑assisted code
analysis can identify complex, protocol‑level weaknesses—signaling a shift toward more automated vulnerability research and advanced
attack variants in the future.
1. Vulnerability Overview
CVE‑2026‑49975, referred to as “HTTP/2 Bomb,” is a Denial of Service (Server Overload DoS) vulnerability that can cause excessiveresource consumption during HTTP/2 request processing. An attacker can exploit it by precisely combining HTTP/2’s HPACK header
compression algorithm with its flow control characteristics, triggering memory expansion loads of tens of gigabytes on the target
server with relatively little network traffic. If the attack succeeds, the web server’s memory and CPU usage can spike sharply,
connections may become hung, and this can lead to response delays, service instability, and access failures for legitimate users.
Accordingly, environments such as web servers, API servers, and reverse proxies with HTTP/2 enabled should assess whether their
infrastructure is affected and perform the relevant patching and configuration checks. In particular, this vulnerability has also
been identified through the use of AI‑based automated code analysis tools, making it a matter of strong concern from a threat intelligence
perspective as it demonstrates the potential for future automated vulnerability discovery and more advanced variant attack techniques.
Key Summary
Unlike a conventional DDoS attack that generates massive traffic, HTTP/2 Bomb is an asymmetric denial‑of‑service (DoS) attack that
can rapidly exhaust a vulnerable server’s resources with relatively little bandwidth and a small number of requests.
By precisely combining HTTP/2’s HPACK header compression processing algorithm (internal resource management logic) with its flow
control characteristics, the attacker sharply increases the server’s memory and CPU usage while keeping connections in a hung state,
causing response delays or service outages.
According to the latest security advisories, potential impact has been reported in the default HTTP/2 configurations of major web servers
such as Nginx, Apache HTTP Server, Microsoft IIS, Envoy, and Cloudflare Pingora, and prompt security patching and configuration review
are strongly recommended for related products.
2. Root Cause
CVE‑2026‑49975 arises from the interaction between HTTP/2’s header compression algorithm and flow control characteristics.The attacker sends manipulated requests to a server with HTTP/2 enabled, causing the server to internally process far more data than
it actually receives on the network.
During this process, the server performs bookkeeping logic to decompress HPACK headers and update its internal dynamic table,
retaining data in memory in a disproportionately large amount relative to the actual payload size and thereby incurring heavy load.
In addition, because the attacker can constrain the window size to zero through flow control characteristics such as a 0‑byte
window update, the server may be unable to send response data and becomes stuck in memory, allowing data to accumulate without
being released and causing memory and CPU usage to rise rapidly.
Ultimately, HTTP/2 Bomb is an attack method that forces resource exhaustion by combining normal protocol features, and
its essence lies in the asymmetry by which a small number of requests can cause massive disruption.
The main causes can be summarized as follows:
- Increased server memory usage during HPACK header decompression.
- Data is not immediately released and remains retained due to flow control characteristics.
- An asymmetric processing structure where small requests lead to large resource consumption.
- An attack surface exposed through external requests in HTTP/2‑enabled environments.
compression algorithm and flow control characteristics together. During HPACK header compression processing, the attacker induces
the server to handle a small input as a much larger internal data structure, causing the server to use more memory than the actual data
it received. If HTTP/2 flow control then prevents the server from immediately releasing the data being processed, memory allocations
related to queued data may accumulate internally. As this process repeats, CPU and memory usage can rise rapidly, eventually leading to
response delays or service disruption.
According to publicly available vulnerability analysis materials, this technique can exhaust server resources even with relatively
low bandwidth, and in some environments service outages may occur within a short period of time.
Resource Exhaustion Flow
1. Start of HTTP/2 request processing
The attacker sends a manipulated request to a server with HTTP/2 enabled.
The server begins processing it as a normal HTTP/2 request.
2. HPACK header decompression
The server decompresses the received header data using the HPACK method.
This process can generate internal processing data larger than the data actually received.
3. Data retention due to flow control
Due to HTTP/2 flow control characteristics, some data may not be immediately processed or released.
As a result, processing backlog data can accumulate in the server’s internal buffers or memory.
4. Increase in resource usage
As the process repeats, the server’s CPU and memory usage rise rapidly.
Consequently, response delays, service instability, and web server process failures may occur.
The key point of this vulnerability is that the processing burden incurred inside the server is greater than the size of the request itself.
Therefore, anomaly detection methods based only on traffic volume or request size may find it difficult to identify suspicious behavior.
4. Impact
The impact of CVE-2026-49975 lies in the fact that even relatively little network traffic can significantly increase the server’s internal CPUand memory usage. Unlike a conventional high-volume DDoS attack, this vulnerability abuses resource consumption that occurs during HTTP/2
request processing, so in vulnerable environments it can lead to degraded service quality or outages within a short time.
In particular, organizations should first assess whether environments such as HTTP/2-enabled web servers, API servers, reverse proxies, and
CDN-integrated systems are affected. In systems where real-time responsiveness is critical, such as consumer-facing services, finance, e-commerce,
and cloud services, response delays, connection instability, and service interruptions can lead to revenue loss and reduced customer trust.
In addition, this vulnerability does not simply involve traffic spikes; it increases the server’s internal processing burden by combining
normal HTTP/2 functions. Therefore, detection methods based only on request size or traffic volume may struggle to identify anomalies, and
administrators should also review the web server version, patch status, HTTP/2 configuration, and connection limiting policies.
It is also noteworthy that this case was identified using AI-based automated tools. Since similar protocol-abuse techniques may be discovered
in the future, it is necessary to reexamine not only patch application but also HTTP/2 operating policies and resource-limiting settings.
5. Response Measures
To address CVE-2026-49975, the first step is to verify whether security patches have been applied to web servers, reverse proxies, andAPI gateways that support HTTP/2. Reviewing vendor advisories and applying the latest security updates is the highest-priority action.
Response Measures by Web Server
Web firewall-based measures
On a web firewall, HTTP/2 Bomb is difficult to detect using simple string-based signature patterns alone.
This attack does not rely on a specific URI or a fixed malicious payload; instead, it causes server resource exhaustion by combining
HTTP/2’s HPACK header compression algorithm with its flow control characteristics.
Therefore, it is appropriate to configure the web firewall with behavior-based detection at the session and stream levels.
Suspicious behavior can be identified when the number of headers in a single request or stream increases excessively,
when repeated HEADERS frames occur within the same session, when Cookie headers arrive split into many fragments, or
when long-lived HTTP/2 connections are accompanied by increased server CPU or memory usage.
However, if traffic is blocked immediately based only on the number of headers or the duration of a connection, legitimate services
may be affected. For that reason, it is necessary to begin in detection mode and establish a baseline of normal traffic. After that,
connection termination, request limiting, rate limiting, and temporary blocking policies should be applied gradually to anomalous
sessions that are repeatedly observed.
In conclusion, responding to this vulnerability requires behavior-based detection that comprehensively analyzes factors such as
header count, stream state, connection duration, and server resource usage, rather than relying solely on simple signature-based blocking.
6. Conclusion
CVE-2026-49975 (HTTP/2 Bomb) is a Denial of Service (DoS) vulnerability that can cause server resource exhaustion by combiningHTTP/2’s HPACK header compression algorithm with its flow control characteristics. Even a relatively small number of requests can increase CPU
and memory usage on vulnerable servers, so affected web servers and reverse proxy environments with HTTP/2 enabled should be prioritized
for impact assessment.
To respond effectively, organizations should first promptly apply security patches from major vendors, review HTTP/2 protocol operating
settings, and strengthen limits on connections, headers, and stream thresholds. In addition, since simple signature-based detection has
limitations, behavior-based detection that correlates sessions and streams should also be deployed in web firewall and proxy layers.
7. Reference
- https://nvd.nist.gov/vuln/detail/CVE-2026-49975
- https://www.openwall.com/lists/oss-security/2026/06/03/3
- https://access.redhat.com/security/cve/cve-2026-49975
- https://www.haproxy.com/blog/haproxy-cve-2026-49975-http2-bomb
- https://www.cve.org/CVERecord?id=CVE-2026-49975
- https://vuldb.com/ko/cve/CVE-2026-49975
- https://www.cycognito.com/blog/emerging-threat-cve-2026-49975-apache-http-server-denial-of-service-via-http-2-memory-exhaustion/
- https://www.imperva.com/blog/imperva-customers-protected-against-cve-2026-49975-http-2-bomb-dos/
- https://ubuntu.com/security/CVE-2026-49975
