Critical Apache HTTP/2 DoS Vulnerability Gets Public Exploit

Key Takeaways

• A critical Denial of Service (DoS) vulnerability, CVE-2026-49975, dubbed the “HTTP/2 Bomb,” has a public proof-of-concept (PoC) exploit.
• The flaw affects Apache HTTP Server versions 2.4.17 through 2.4.67, allowing unauthenticated remote attackers to exhaust server memory.
• Successful exploitation leads to service disruption and takes servers offline.
• A patch is available in Apache HTTP Server 2.4.68 and later.

A severe Denial of Service vulnerability impacting Apache HTTP Server, identified as CVE-2026-49975 and colloquially termed the “HTTP/2 Bomb,” now has a publicly accessible exploit. This development significantly elevates the risk for organizations operating unpatched Apache deployments, as the flaw enables remote attackers to deplete server memory and disrupt services without requiring any authentication.

The vulnerability resides within the HTTP/2 request processing mechanism of the Apache HTTP Server. Specifically, it manifests when multiple cookie header fields are handled. The server merges these fields without properly accounting for them against the LimitRequestFields directive, effectively bypassing a crucial resource protection measure designed to prevent such abuse.

Attackers can exploit this by crafting a small, HPACK-encoded HTTP/2 request. This seemingly innocuous request is designed to decompress into an exceptionally large number of cookie header fields. As the server proceeds with merging these cookie headers, it is compelled to repeatedly allocate memory for each field’s expansion, leading to excessive resource consumption.

To sustain the attack and prevent memory release, the attacker then leverages HTTP/2 flow control. By setting the initial window size to zero, they deliberately stall the transmission of the response, keeping the affected streams open indefinitely. This prevents the server from deallocating the memory, thereby creating a persistent state of memory exhaustion.

Public Exploit for HTTP/2 Bomb

All Apache HTTP Server versions ranging from 2.4.17 up to and including 2.4.67 are susceptible to this vulnerability. The critical fix has been integrated into Apache HTTP Server 2.4.68 and subsequent versions.

The publicly released proof-of-concept (PoC) exploit, hosted on GitHub at EQSTLab/CVE-2026-49975, showcases the attack via a Python-based script. This exploit has been successfully reproduced in a Dockerized environment, specifically targeting a server container configured with an 8 GB memory limit.

The Python script allows attackers to fine-tune several parameters, including:

• Connections and streams: Configuring the number of concurrent HTTP/2 connections and streams (e.g., 10 connections with 100 streams each).
• HPACK references: Utilizing up to 4,091 header table references to maximize the expansion of cookie fields.
• Flow control hold: Setting the initial window size to 0 to halt data transmission for durations up to 300 seconds.
• Drip-feeding: Releasing a minimal 1 byte every 2 seconds to artificially maintain the open status of streams.

During controlled testing, the memory consumption within the Apache container was observed to escalate sharply and remain at elevated levels throughout the specified hold period, unequivocally confirming successful memory exhaustion. A successful exploitation of this vulnerability results in remote Denial of Service, characterized by excessive memory usage and the delayed or outright failure of legitimate user requests, effectively rendering the server inoperable without requiring any privileged access.

What You Should Do

• Immediately upgrade all vulnerable Apache HTTP Server instances to version 2.4.68 or newer.
• If immediate patching is not feasible, consider temporarily disabling HTTP/2 on servers where it is not a critical operational requirement.
• Implement robust monitoring for unusual memory consumption patterns in web server processes or containers, as this can serve as an early indicator of an ongoing attack.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.