HTTP/2 Bomb (CVE-2026-49975) is a remote denial-of-service attack that combines HTTP/2 HPACK header compression with flow-control behavior that keeps response data from being released. An unauthenticated attacker can turn limited network traffic into repeated large server-side allocations, causing latency, memory exhaustion, or process failure. NVD and vendor advisories rate it CVSS v3.1 7.5 HIGH. It is a resource-exhaustion issue, not a code-execution or information-disclosure vulnerability.
Immediate Actions
- ✓Update NGINX to 1.29.8 or later, or install the distribution package that explicitly fixes CVE-2026-49975
- ✓Update Apache HTTP Server to 2.4.68 or later
- ✓For IIS, Envoy, Pingora, and other implementations, follow the vendor advisory and apply a fixed release or the vendor's official HTTP/2-disable procedure
- ✓After remediation, monitor HTTP/2 connections, process memory, restarts, and response latency
How the Vulnerability Consumes Resources
HPACK lets a sender use a short indexed reference that expands to a previously stored, much longer header value on the receiver. The attacker repeats that compression advantage across many headers and keeps the HTTP/2 flow-control window constrained so the server cannot make progress and release the allocated response state. Red Hat describes the issue as HTTP/2 HPACK denial of service affecting httpd, NGINX, and Envoy. Ubuntu describes NGINX incorrectly handling crafted cookie headers and consuming excessive resources.
Product-Specific Updates
NGINX 1.29.8 or later is identified as fixed. Distribution packages need separate verification: Ubuntu's first update introduced a regression and was temporarily reverted, and USN-8398-3 provides the complete fix. On packaged systems, install the release that the operating-system vendor explicitly marks as fixing CVE-2026-49975 and verify the running package after the service restarts.
Apache HTTP Server 2.4.17 through 2.4.67 is affected and 2.4.68 contains the fix. When a vendor has not released a patch, as with some IIS deployments at disclosure time, disable HTTP/2 only through that vendor's documented procedure or apply its published mitigation. An improvised NGINX directive or WAF signature is not guaranteed to stop server-side resource amplification.
Monitoring After Remediation
After updating or mitigating, monitor HTTP/2 connection counts, worker memory, out-of-memory termination, abnormal restarts, and response latency. Memory limits and restart policies can reduce the blast radius but do not correct the vulnerable HTTP/2 implementation. If a CDN or reverse proxy fronts the service, determine whether HTTP/2 terminates at the edge, the origin, or both, and assess every terminating product.
📦