The New HTTP/2 Bomb DoS Attack: Small Requests, Massive Damage
June 5th, 2026
❓What:
Researchers at offsec firm Calif disclosed a new denial-of-service (DoS) attack dubbed HTTP/2 Bomb that can crash major web servers using a single client system. The attack combines two previously known HTTP/2 weaknesses:
HPACK compression amplification; which causes small requests to consume large amounts of server memory.
HTTP/2 flow-control abuse; which prevents that memory from being released.
The attack affects default HTTP/2 configurations on major web-server platforms including NGINX, Apache HTTP Server, Microsoft IIS, Envoy, and Cloudflare Pingora. Researchers demonstrated that a single host on a 100 Mbps connection could exhaust tens of gigabytes of server memory in seconds.
⚠️Impact:
A single attacker can cause rapid memory exhaustion without requiring a large botnet.
Testing showed:
Envoy exhausted 32 GB RAM in ~10 seconds
Apache exhausted 32 GB RAM in ~18 seconds
NGINX exhausted 32 GB RAM in ~45 seconds
IIS exhausted 64 GB RAM in ~45 seconds
Successful exploitation can render websites and APIs unavailable, causing service outages and business disruption.
The attack is particularly concerning because it leverages default configurations and bypasses many existing header-size-based protections.
💡Recommendations:
Apply vendor patches and updates as they become available for affected web server software.
Place web services behind a current-gen Content Delivery Network (CDN), reverse proxy, or DDoS protection service to reduce direct exposure of vulnerable HTTP/2 endpoints.
Review HTTP/2 configurations, including header-count limits, flow-control settings, and connection timeout values.
Monitor for abnormal memory utilization and HTTP/2 connection patterns that may indicate exploitation attempts.
Where feasible, consider temporarily disabling HTTP/2 on exposed services until mitigations are validated.
Read the full story HERE