New 'HTTP/2 Bomb' DoS attack crashes web servers in under a minute
A new denial-of-service (DoS) attack, dubbed ‘HTTP/2 Bomb,’ has been identified that can cripple web servers within seconds by exploiting vulnerabilities in default HTTP/2 configurations of popular web servers like Nginx, Apache, and IIS. The attack leverages HPACK compression amplification combined with flow control stalling to exhaust server memory, and proof-of-concept exploits have been released. While not entirely novel, the combination of techniques has a significant impact, and patches are now available for affected servers.
The HTTP/2 Bomb attack targets the HPACK compression mechanism used in HTTP/2, exploiting a flaw where a single client can trigger massive memory allocation on a vulnerable server. Researchers at Calif discovered this by combining the HPACK compression amplification technique with Slowloris-style resource retention via HTTP/2 flow-control stalling. This allows a client with a modest connection (e.g., 100 Mbps) to consume tens of gigabytes of RAM within seconds, effectively bringing the server to a standstill. The attack specifically targets the way servers manage HTTP/2 flow control, preventing the release of allocated memory even after the initial request completes.
Testing against several major web servers revealed varying levels of vulnerability. Envoy 1.37.2 exhausted 32 GB RAM in approximately 10 seconds, while Apache httpd 2.4.67 required around 18 seconds to reach the same threshold. Nginx 1.29.7 took approximately 45 seconds, and IIS (Windows Server 2025) consumed 64 GB RAM in about 45 seconds. The researchers emphasize that while the individual techniques aren't new, their combination creates a potent DoS attack.
Several mitigation strategies are available, including applying patches released for Nginx and Apache, disabling HTTP/2 where feasible, and deploying reverse proxies or firewalls with strict header-count limits. The vulnerability highlights a gap in the specifications regarding memory amplification risks within HTTP/2 and the potential for attackers to indefinitely hold allocated memory. Patches have been released for Nginx (1.29.8) and Apache (mod_http2 2.0.41), addressing the identified issue.