New “HTTP/2 Bomb” attack can exhaust server memory in seconds
Researchers have disclosed a new denial-of-service (DoS) technique dubbed HTTP/2 Bomb, a memory-exhaustion attack that can render major web servers inaccessible within seconds. The attack affects the default HTTP/2 configurations of nginx, Apache HTTP Server, Microsoft IIS, Envoy, and Cloudflare Pingora. The attack was discovered by Codex and publicly disclosed on June 2, 2026. Researchers … The post New “HTTP/2 Bomb” attack can exhaust server memory in seconds appeared first on CyberInsider.
A new denial-of-service (DoS) technique, HTTP/2 Bomb, can exhaust server memory in seconds by combining two known HTTP/2 abuse techniques, targeting HPACK header compression and flow control.
Read the full article
This is a curated summary. The complete article is available at Cyber Insider.