Remote DoS “HTTP/2 Bomb” Vulnerability Threatens NGINX, Apache, IIS, Envoy, and Cloudflare
What Happened — Researchers identified a remote denial‑of‑service (DoS) flaw, dubbed HTTP/2 Bomb, that can be triggered against the default HTTP/2 configuration of major web‑server platforms. By sending a crafted sequence of HTTP/2 frames, an attacker can exhaust server resources and cause an abrupt shutdown, affecting any service that relies on these servers.
Why It Matters for TPRM —
- The affected servers are foundational components for SaaS, cloud‑hosting, and enterprise web applications, making the risk highly transitive across supply chains.
- A successful DoS can render critical business services unavailable, leading to contractual penalties, reputation damage, and downstream customer impact.
- Many third‑party vendors have not yet released mitigations, increasing exposure for organizations that depend on their hosted services.
Who Is Affected — Technology & SaaS providers, financial services platforms, e‑commerce sites, healthcare portals, and any organization that outsources web‑hosting or uses cloud‑based APIs built on NGINX, Apache HTTPD, Microsoft IIS, Envoy, or Cloudflare Pingora.
Recommended Actions —
- Verify that all web‑servers are running the latest patched versions released by the vendors.
- If patches are unavailable, consider disabling HTTP/2 or applying vendor‑recommended configuration hardening (e.g., limiting concurrent streams).
- Conduct a rapid inventory of all third‑party services that rely on the affected servers and request remediation status.
- Update incident‑response playbooks to include detection of abnormal HTTP/2 frame patterns.
Technical Notes — The flaw resides in the handling of HTTP/2 SETTINGS and WINDOW_UPDATE frames, allowing an attacker to create a “bomb” of tiny frames that exhaust memory and CPU. No CVE identifier has been assigned at the time of reporting; vendors are expected to publish CVE‑2026‑XXXX in the coming weeks. No data exfiltration is involved; the impact is limited to service disruption. Source: https://thehackernews.com/2026/06/new-http2-bomb-vulnerability-allows.html