CVE-2025-53020
CVSS 7.5 HIGH: late Release of Memory after Effective Lifetime vulnerability in Apache HTTP Server. This issue affects Apache HTTP… EPSS 5% (91st percentile).
Vulnerabilities & Exploits
Major HTTP/2 front ends share a failure mode that a tiny client can trigger fast: memory grows in server-side header bookkeeping, not in the decoded request itself, so normal request-size limits miss it. A zero-byte flow-control hold then keeps that memory pinned until the service stalls.
Calif’s new PoC, dubbed HTTP/2 Bomb, chains HPACK amplification (CVE-2016-6581) with a connection hold and says the issue hits default HTTP/2 configurations on NGINX, Apache HTTP Server, Microsoft IIS, Envoy, and Cloudflare Pingora. The report says a single client can hold 32GB of memory against Apache HTTPD and Envoy in about 20 seconds, and notes Apache HTTP Server 2.4.64 / mod_http2 v2.0.41 and NGINX 1.29.8+ as fixes on the affected stack.
The practical risk is a low-bandwidth outage against edge tiers that trust HTTP/2 defaults. The shared behavior means this is a cross-vendor availability problem, not a single-product bug.
4 sources · Jun 4
CVSS 7.5 HIGH: late Release of Memory after Effective Lifetime vulnerability in Apache HTTP Server. This issue affects Apache HTTP… EPSS 5% (91st percentile).
CSO Online
Codex reunites researcher with a 14-year-old HTTP/2 blind spot
Researchers disclose an HTTP/2 denial-of-service technique affecting web servers including nginx and Apache after AI-assisted analysis uncovered a flaw linked to HTTP/2 configurations.
originalBleepingComputer
New 'HTTP/2 Bomb' DoS attack crashes web servers in under a minute
A new denial-of-service (DoS) attack dubbed HTTP/2 Bomb can be launched from a single machine to take down web servers within seconds.
originalThe Hacker News
New HTTP/2 Bomb Vulnerability Allows Remote DoS on NGINX, Apache, IIS, Envoy & Cloudflare
HTTP/2 Bomb exploits HPACK and flow control; a single client can hold 32GB memory in 20 seconds, causing server outages.
originalPart of the PlainSec briefing for 2026-06-03
Every edition of this story: HTTP/2 Defaults Share a Fast Memory-Exhaustion Path