Blog • 10w
HTTP/2 Compression Bomb Exploit Targets Apache, Nginx, and Microsoft IIS
Researchers at Calif have identified the "HTTP/2 Bomb," a synergistic denial-of-service (DoS) exploit targeting the HPACK (RFC 7541) compression mechanism and HTTP/2 flow control. The attack chain utilizes malicious header blocks to trigger massive per-entry memory allocation during decompression, followed by a Slowloris-style "hold" achieved via zero-byte flow-control windows. This prevents servers from releasing allocated resources, enabling a single client on a 100 Mbps connection to exhaust up to 32 GB of RAM within seconds. The vulnerability affects major web servers including Apache, Nginx, Microsoft IIS, Envoy, and Cloudflare Pingora, primarily due to insecure default configurations across the industry.