Summary
A pair of newly disclosed HTTP/2 denial-of-service vulnerabilities dubbed the “HTTP/2 Bomb” are sending shockwaves through the web infrastructure community. CVE-2026-49975 affects the default HTTP/2 configurations of Apache HTTP Server, NGINX, Microsoft IIS, Envoy, and Cloudflare Pingora. A related flaw, CVE-2026-49160, specifically targets Windows HTTP.sys.
The attack chains two techniques — an HPACK compression bomb and an HTTP/2 low-and-slow hold (similar to Slowloris) — to trigger massive memory allocation on target servers. A single machine with a 100Mbps connection can render vulnerable servers inaccessible within seconds by forcing them to allocate and hold tens of gigabytes of memory. Notably, CVE-2026-49975 was discovered by security firm Calif using OpenAI’s Codex AI agent, marking a significant milestone in AI-assisted vulnerability research.
Patches are available: Apache has released mod_http2 v2.0.41, NGINX has deployed fixes in release 1.29.8, and Microsoft has addressed CVE-2026-49160 with a MaxHeadersCount registry mitigation. Organizations unable to patch immediately should consider disabling HTTP/2 or deploying perimeter protections like HAProxy, which is architecturally resistant to this class of attack.
Sources
- SecurityWeek — HTTP/2 Bomb Exploit Knocks Web Servers Offline in Seconds
- HAProxy — CVE-2026-49975 HTTP/2 Bomb Analysis
- CSO Online — HTTP/2 Bomb DoS Attack
Commentary
The HTTP/2 Bomb is a nasty reminder that protocol-level vulnerabilities can have enormous blast radius. Nearly every major web server platform is affected, and the attack is trivially cheap to execute — one modest connection can take down production infrastructure. This is the kind of vulnerability that will be weaponized by script kiddies and DDoS-for-hire services within days of disclosure.
The AI angle is equally significant. This vulnerability was discovered by an AI coding agent, not a human researcher. Whether you find that exciting or terrifying (probably both), it signals that the pace of vulnerability discovery is about to accelerate dramatically. Defenders need to internalize that patching windows are shrinking, and “we’ll get to it next sprint” is increasingly becoming “we got popped last Tuesday.”