Vulnerabilities & Exploits

HTTP/2 Defaults Share a Fast Memory-Exhaustion Path

Major HTTP/2 front ends share a failure mode that a tiny client can trigger fast: memory grows in server-side header bookkeeping, not in the decoded request itself, so normal request-size limits miss it. A zero-byte flow-control hold then keeps that memory pinned until the service stalls.

Calif’s new PoC, dubbed HTTP/2 Bomb, chains HPACK amplification (CVE-2016-6581) with a connection hold and says the issue hits default HTTP/2 configurations on NGINX, Apache HTTP Server, Microsoft IIS, Envoy, and Cloudflare Pingora. The report says a single client can hold 32GB of memory against Apache HTTPD and Envoy in about 20 seconds, and notes Apache HTTP Server 2.4.64 / mod_http2 v2.0.41 and NGINX 1.29.8+ as fixes on the affected stack.

The practical risk is a low-bandwidth outage against edge tiers that trust HTTP/2 defaults. The shared behavior means this is a cross-vendor availability problem, not a single-product bug.

4 sources · Jun 4

CVE-2025-53020

NVD KEV

CVSS 7.5 HIGH: late Release of Memory after Effective Lifetime vulnerability in Apache HTTP Server. This issue affects Apache HTTP… EPSS 5% (91st percentile).

Timeline

Jun 4 Reported by CSO Online
Jun 3 Reported by BleepingComputer

Sources

Jun 4 CSO Online
Codex reunites researcher with a 14-year-old HTTP/2 blind spot
Researchers disclose an HTTP/2 denial-of-service technique affecting web servers including nginx and Apache after AI-assisted analysis uncovered a flaw linked to HTTP/2 configurations.
original
Jun 3 BleepingComputer
New 'HTTP/2 Bomb' DoS attack crashes web servers in under a minute
A new denial-of-service (DoS) attack dubbed HTTP/2 Bomb can be launched from a single machine to take down web servers within seconds.
original
Jun 3 The Hacker News
New HTTP/2 Bomb Vulnerability Allows Remote DoS on NGINX, Apache, IIS, Envoy & Cloudflare
HTTP/2 Bomb exploits HPACK and flow control; a single client can hold 32GB memory in 20 seconds, causing server outages.
original

Vendor digest: Microsoft

Vendor digest: F5

Part of the PlainSec briefing for 2026-06-04

Every edition of this story: HTTP/2 Defaults Share a Fast Memory-Exhaustion Path

More from today

Vulnerabilities & ExploitsHTTP/2 Defaults Share a Fast Memory-Exhaustion PathMajor HTTP/2 front ends share a failure mode that a tiny client can trigger fast: memory grows in server-side header bookkeeping, not in the decoded request itself, so normal request-size limits miss it. A zero-byte flow-control hold then keeps that memory pinned until the service stalls.Calif’s new PoC, dubbed HTTP/2 Bomb, chains HPACK amplification (CVE-2016-6581) with a connection hold and says the issue hits default HTTP/2 configurations on NGINX, Apache HTTP Server, Microsoft IIS, Envoy, and Cloudflare Pingora. The report says a single client can hold 32GB of memory against Apache HTTPD and Envoy in about 20 seconds, and notes Apache HTTP Server 2.4.64 / mod_http2 v2.0.41 and NGINX 1.29.8+ as fixes on the affected stack.The practical risk is a low-bandwidth outage against edge tiers that trust HTTP/2 defaults. The shared behavior means this is a cross-vendor availability problem, not a single-product bug.4 sources · Jun 4

CVE-2025-53020

NVD KEV

CVSS 7.5 HIGH: late Release of Memory after Effective Lifetime vulnerability in Apache HTTP Server. This issue affects Apache HTTP… EPSS 5% (91st percentile).

Timeline

Jun 4 Reported by CSO Online

Jun 3 Reported by BleepingComputer

Sources

Jun 4 CSO Online

Codex reunites researcher with a 14-year-old HTTP/2 blind spot

Researchers disclose an HTTP/2 denial-of-service technique affecting web servers including nginx and Apache after AI-assisted analysis uncovered a flaw linked to HTTP/2 configurations.

original

Jun 3 BleepingComputer

New 'HTTP/2 Bomb' DoS attack crashes web servers in under a minute

A new denial-of-service (DoS) attack dubbed HTTP/2 Bomb can be launched from a single machine to take down web servers within seconds.

original

Jun 3 The Hacker News

New HTTP/2 Bomb Vulnerability Allows Remote DoS on NGINX, Apache, IIS, Envoy & Cloudflare

HTTP/2 Bomb exploits HPACK and flow control; a single client can hold 32GB memory in 20 seconds, causing server outages.

original

Vendor digest: MicrosoftVendor digest: F5Part of the PlainSec briefing for 2026-06-04Every edition of this story: HTTP/2 Defaults Share a Fast Memory-Exhaustion PathMore from today

WordPress Form Bug Hands Out Admin Access

New Kirki Release Put Admin Accounts at Risk

RTU500 Firmware Advisory Spans Multiple Branches