HTTP/2 Defaults Share a Fast Memory-Exhaustion Path
Major HTTP/2 front ends share a failure mode that a tiny client can trigger fast: memory grows in server-side header bookkeeping, not in the decoded request itself, so normal request-size limits miss it. A zero-byte flow-control hold then keeps that memory pinned until the service stalls.
Calif’s new PoC, dubbed HTTP/2 Bomb, chains HPACK amplification (CVE-2016-6581) with a connection hold and says the issue hits default HTTP/2 configurations on NGINX, Apache HTTP Server, Microsoft IIS, Envoy, and Cloudflare Pingora. The report says a single client can hold 32GB of memory against Apache HTTPD and Envoy in about 20 seconds, and notes Apache HTTP Server 2.4.64 / mod_http2 v2.0.41 and NGINX 1.29.8+ as fixes on the affected stack.
The practical risk is a low-bandwidth outage against edge tiers that trust HTTP/2 defaults. The shared behavior means this is a cross-vendor availability problem, not a single-product bug.