CVE-2026-49975: 
NGINX vulnerability analysis and mitigation

CVE-2026-49975 is a Memory Allocation with Excessive Size Value vulnerability (CWE-789) in Apache HTTP Server's mod_http2 module that allows unauthenticated remote attackers to cause denial of service via malicious HTTP/2 requests. The vulnerability affects Apache HTTP Server versions 2.4.17 through 2.4.67, as well as F5 nginx prior to 1.29.8 and Debian Linux 11.0. It was reported on May 26, 2026, fixed upstream on May 27, and publicly disclosed with the release of Apache HTTP Server 2.4.68 on June 8, 2026. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (Apache Advisory, GitHub Advisory, oss-security).

The vulnerability is rooted in how Apache's mod_http2 handles HTTP/2 HPACK header compression combined with HTTP/2 flow-control mechanisms (CWE-789). An attacker exploits the fact that HTTP/2 allows a client to send a large number of cookie header crumbs — which are individually small but collectively cause the server to allocate excessive memory when reassembled — while keeping the connection open via flow-control stalling, pinning allocated memory indefinitely. The attack chains two long-known HTTP/2 behaviors: HPACK header amplification (with reported ratios up to 5,700:1 on some servers) and the ability to hold streams open cheaply, creating what researchers dubbed an "HTTP/2 Bomb." The fix in Apache involved making cookie headers count against LimitRequestFields in mod_http2 v2.0.41 (commit 47d3100b), and nginx addressed it by importing the max_headers directive (capped at 1000 by default) in version 1.29.8 (oss-security, oss-security CVE).

Successful exploitation results in complete denial of service — an unauthenticated attacker from a single client connection can exhaust server memory (reported as up to 32 GB in approximately 10 seconds in PoC testing), crashing or severely degrading the affected web server within under a minute. The impact is limited to availability; there is no confidentiality or integrity impact. Affected infrastructure includes any HTTP/2-enabled deployment of Apache HTTP Server 2.4.17–2.4.67, nginx prior to 1.29.8, Microsoft IIS, Envoy, and Cloudflare Pingora in their default configurations, potentially affecting hundreds of thousands of internet-facing servers (oss-security, Imperva).

1. Reconnaissance: Identify internet-facing HTTP/2-enabled servers running Apache HTTP Server 2.4.17–2.4.67 or nginx < 1.29.8 using tools like Shodan, Censys, or the public detection script (detect_http2_bomb.sh) that checks response headers for HTTP/2 support and server version banners.
2. Establish HTTP/2 connection: Open a single HTTP/2 connection to the target server. No authentication or special privileges are required.
3. Craft HPACK-amplified headers: Construct HTTP/2 requests containing a very large number of cookie header crumbs (e.g., --headers 16374) that exploit HPACK compression. Each crumb is small on the wire but expands significantly in server memory upon decompression, achieving amplification ratios of up to 5,700:1.
4. Multiplex across streams: Open multiple concurrent HTTP/2 streams (e.g., --streams 30) within the same connection, multiplying the memory allocation effect across streams simultaneously.
5. Stall streams via flow control: Use HTTP/2 flow-control mechanisms to hold streams open without completing requests, preventing the server from freeing allocated memory. This pins gigabytes of RAM for the duration of the attack.
6. Exhaust server memory: Repeat across multiple threads (e.g., --threads 50) until the server's available memory is exhausted, causing OOM conditions, process crashes, or complete service unavailability — achievable in under 60 seconds from a single client (oss-security, PoC-mrx-arafat).

• Network: Sudden spike in HTTP/2 connections from a single or small number of source IPs; unusually high number of concurrent HTTP/2 streams per connection; connections that remain open for extended periods without completing requests; large volumes of HEADERS frames with excessive cookie fields.
• Logs: Apache access logs showing repeated requests with abnormally large Cookie: header values or high header counts; error logs showing memory allocation failures or worker process crashes (child pid XXXX exit signal Killed); nginx logs showing connections with header counts near or exceeding the max_headers limit.
• Process/System: Rapid memory consumption by httpd or nginx worker processes visible via top/htop; OOM killer events in /var/log/kern.log or dmesg targeting web server processes; unexpected worker process restarts or crashes.
• Resource Metrics: Server memory utilization climbing to near 100% within seconds of connection establishment; swap usage spike; significant drop in server response rates or complete service unavailability (oss-security, Imperva).

Primary remediation: Upgrade Apache HTTP Server to version 2.4.68 or later, which includes the fix in mod_http2 v2.0.41 (cookie headers now count against LimitRequestFields). For nginx, upgrade to version 1.29.8 or later, which adds the max_headers directive defaulting to 1000 (Apache Security Page, oss-security CVE).

Workarounds if patching is not immediately possible:

• Apache: Disable HTTP/2 by setting Protocols http/1.1 in the configuration. Lowering LimitRequestFieldSize reduces per-stream blast radius but is only a partial mitigation.
• nginx: Disable HTTP/2 with http2 off; in the server block.
• Microsoft IIS, Envoy, Cloudflare Pingora: Disable HTTP/2 or front the server with a proxy that enforces a hard cap on header count per request.
• General: Cap per-worker memory using cgroups, ulimit -v, or container limits so that a bombed worker is OOM-killed and respawned before dragging the entire host into swap (oss-security).

The vulnerability generated significant media and community attention, largely due to its novel discovery method — OpenAI Codex autonomously composed the exploit by reading public HTTP/2 codebases and recognizing the composability of two decade-old weaknesses, which was widely covered by BleepingComputer, SecurityWeek, The Register, CSO Online, and Dark Reading (oss-security). Imperva published a blog post confirming their customers were protected and providing technical analysis (Imperva). HAProxy, Webtide (Jetty), and 3CX each published vendor-specific advisories or blog posts addressing the vulnerability's impact on their products. Microsoft's IIS team engaged via the Microsoft Tech Community, and the Hong Kong GovCERT issued an alert. Reddit communities (r/selfhosted, r/SecOpsDaily) discussed the attack's severity, with one thread titled "HTTP/2 Bomb: one client can kill your server in 10s" gaining notable traction. The broader takeaway highlighted by researchers is that RFC 7541's §7.3 on memory consumption was insufficient, as five independent implementations all shipped the same class of bug.