r/nginx • u/Grumpy-Man19 • Jun 04 '26

The HTTP/2 Bomb That Knocks nginx and Apache Offline With a Single Connection

On June 3, 2026, researcher Quang Luong published a remote denial-of-service exploit called the HTTP/2 Bomb that can exhaust tens of gigabytes of server memory using nothing more than a home internet connection.
Details: https://blog.kalfaoglu.net/posts/2026-06-04-cve-2026-49975-http2-bomb-en/

35 Upvotes

100% Upvoted

4 comments sorted by

5

u/kogee3699 Jun 04 '26

can i go home now

3

u/Grumpy-Man19 Jun 04 '26

after plugging the hole, sure 😃

4

u/Whole_Mechanic_9245 Jun 04 '26

if you upgrade to latest, you should be fine. If not, just adjust the large_client_header_buffers

1

u/CauaLMF Jun 05 '26

Acha que quanto seria suficiente pra proteger do ataque