A proof-of-concept (PoC) exploit has been publicly released for a critical Denial of Service (DoS) vulnerability in the Apache HTTP Server. Tracked as CVE-2026-49975 and dubbed the “HTTP/2 Bomb,” the flaw allows remote, unauthenticated attackers to exhaust server memory and bring down targeted services.
Warning: Organizations running unpatched Apache deployments face a significant risk of service disruption and are urged to update their systems immediately.
How the 'HTTP/2 Bomb' Works
The vulnerability is rooted in the HTTP/2 request-handling path of the Apache HTTP Server. The core issue occurs when multiple Cookie header fields are processed; they are merged together without being properly counted against the LimitRequestFields directive. This oversight effectively bypasses a crucial resource exhaustion protection mechanism.
To exploit this flaw, an attacker executes the following sequence:
- HPACK Decompression Abuse: The attacker crafts a highly compressed, HPACK-encoded HTTP/2 request. When decompressed by the server, this small request expands into a massive number of
Cookieheader fields. - Memory Allocation Exhaustion: During the
Cookieheader merging process, the server is forced into a loop of repeatedly allocating memory for each field expansion. - Weaponized Flow Control: To maximize the impact, the attacker sets the HTTP/2 initial window size to zero. This deliberately stalls the server's response transmission, keeping the affected streams open indefinitely and preventing the server from releasing the trapped memory.
The combination of massive memory allocation and stalled transmission creates a sustained memory exhaustion condition, effectively rendering the server incapable of handling legitimate traffic.
PoC Exploit Details
The exploit code is currently available to the public on GitHub at https://github.com/EQSTLab/CVE-2026-49975. The Python-based script demonstrates the severe impact of the vulnerability.
Security researchers have successfully reproduced the attack in a Dockerized environment featuring an Apache server capped at an 8 GB memory limit. During testing, observable memory usage in the container climbed steeply and remained elevated for the duration of the attack.
The script allows attackers to customize several parameters to optimize the DoS condition:
- Connections and Streams: Controls the volume of concurrent HTTP/2 connections and streams (e.g., establishing 10 connections with 100 streams each).
- HPACK References: Utilizes up to 4,091 header table references to maximize the physical memory expansion of the cookie fields.
- Flow Control Hold: Drops the initial window size to
0, halting data transmission and locking up server resources for up to 300 seconds. - Drip-Feeding: Trickles just 1 byte of data every 2 seconds to artificially keep the connection streams alive, bypassing timeout closures.
Affected Versions and Mitigations
The HTTP/2 Bomb vulnerability impacts a wide range of legacy and recent Apache deployments. A successful exploit requires no privileges and results in immediate remote Denial of Service, delayed request processing, and potential offline states.
Vulnerable Versions:
- Apache HTTP Server 2.4.17 through 2.4.67
Recommended Actions:
To protect your infrastructure, NETTWERKED Security News recommends the following immediate actions:
- Patch Immediately: Upgrade all instances to Apache HTTP Server 2.4.68 or later, which contains the official patch for this vulnerability.
- Disable HTTP/2: If immediate patching is not operationally feasible, temporarily disable the HTTP/2 protocol on your servers until an upgrade window is available.
- Monitor Resources: Implement strict monitoring for anomalous memory growth patterns in web server containers or associated processes to detect early signs of an HTTP/2 Bomb attack.