Researchers at Calif have identified the "HTTP/2 Bomb," a synergistic denial-of-service (DoS) exploit targeting the HPACK (RFC 7541) compression mechanism and HTTP/2 flow control. The attack chain utilizes malicious header blocks to trigger massive per-entry memory allocation during decompression, followed by a Slowloris-style "hold" achieved via zero-byte flow-control windows. This prevents servers from releasing allocated resources, enabling a single client on a 100 Mbps connection to exhaust up to 32 GB of RAM within seconds. The vulnerability affects major web servers including Apache, Nginx, Microsoft IIS, Envoy, and Cloudflare Pingora, primarily due to insecure default configurations across the industry.

• Exploitation Mechanics: The HPACK and Flow-Control Chain

  • Leverages HPACK (RFC 7541) by targeting per-entry bookkeeping rather than traditional large-value table stuffing.
  • Utilizes small, malicious header blocks that force disproportionately large memory allocations upon decompression.
  • Employs HTTP/2 flow-control stalling by advertising a zero-byte window, preventing the server from flushing buffers.
  • Uses periodic one-byte WINDOW_UPDATE frames to maintain connection persistence, effectively creating a "hold" on allocated RAM.

• Attack Impact: Rapid Resource Exhaustion

  • Demonstrated ability to exhaust 32 GB of server RAM in approximately 10 to 18 seconds.
  • Achieves extreme amplification, allowing a standard 100 Mbps home connection to paralyze enterprise-grade infrastructure.
  • Disrupts service availability within seconds of attack onset due to the speed of memory exhaustion.
  • Bypasses standard volume-based WAF filters by using minimal ingress traffic and highly compressed payloads.

• Affected Ecosystem: Broad Infrastructure Risk

  • Impacts major web server implementations: Apache HTTP Server, Nginx, Microsoft IIS, Envoy, and Cloudflare Pingora.
  • Estimated to affect over 880,000 websites globally that utilize HTTP/2 with default configurations.
  • Vulnerability persists in environments where default resource limits for header lists and connection timeouts are not strictly enforced.

• Mitigation & Defense: Strengthening HTTP/2 Implementations

  • Update Nginx to version 1.29.8+ to utilize the new max_headers directive for limiting header counts.
  • Apply recent Apache HTTPD patches to address amplification vulnerabilities (e.g., resolving CVE-2025-53020).
  • Implement strict limits on SETTINGS_MAX_HEADER_LIST_SIZE and enforce aggressive connection timeouts to prevent flow-control stalling.
  • Deploy reverse proxies or WAFs configured to enforce strict header-count limits and inspect for HPACK anomalies.