HTTP/2 Compression Bomb Exploit Targets Apache, Nginx, and Microsoft IIS
Researchers at Calif have identified the "HTTP/2 Bomb," a synergistic denial-of-service (DoS) exploit targeting the HPACK (RFC 7541) compression mechanism and HTTP/2 flow control. The attack chain utilizes malicious header blocks to trigger massive per-entry memory allocation during decompression, followed by a Slowloris-style "hold" achieved via zero-byte flow-control windows. This prevents servers from releasing allocated resources, enabling a single client on a 100 Mbps connection to exhaust up to 32 GB of RAM within seconds. The vulnerability affects major web servers including Apache, Nginx, Microsoft IIS, Envoy, and Cloudflare Pingora, primarily due to insecure default configurations across the industry.
F5 NGINX Emergency Patches for Critical 'NGINX Rift' RCE CVE-2026-42945
F5 has issued emergency patches for CVE-2026-42945, a critical heap buffer overflow vulnerability within the NGINX rewrite module, known as "NGINX Rift." Discovered through AI-driven LLM grounding, this flaw has persisted in legacy code for approximately 18 years. The vulnerability enables unauthenticated Remote Code Execution (RCE) and Denial of Service (DoS) by exploiting specific 'rewrite' rule syntax. Given NGINX's ubiquity as a reverse proxy, API gateway, and edge load balancer, the attack surface is massive, posing a significant risk of complete system compromise and service disruption for critical internet-facing infrastructure.