A zero-day vulnerability capable of crashing enterprise web servers in under a minute — using nothing more than a home broadband connection — sounds like something out of a cyberpunk thriller. But as of June 2026, it is very much a real and present danger. The newly disclosed HTTP/2 Bomb exploit is putting organisations across every sector on high alert, and two industries face particularly acute risk: telecommunications and healthcare. Here's what you need to know, why these sectors are in the crosshairs, and — most importantly — what you can do about it right now.
What Is the HTTP/2 Bomb? A Breaking Threat Explained
Earlier this spring, Calif security researcher Quang Luong used OpenAI's Codex to discover an exploit now referred to as the "HTTP/2 Bomb."
Formally tracked as CVE-2026-49975, it creatively chains together two old, nondescript features of a core web technology to help attackers amplify junk traffic by orders of magnitude — and by causing denial-of-service (DoS) attacks without any need for authentication, the issue received a high-severity 7.5 CVSS score.
Dubbed HTTP/2 Bomb, the exploit combines a compression bomb that targets HTTP/2's header compression scheme (HPACK) with a Slowloris-style hold that prevents the server from freeing memory.
The result is catastrophic resource exhaustion that defenders are only beginning to fully reckon with.
What makes this vulnerability particularly unsettling is its sheer accessibility to attackers.
When combined, a single client on a 100 Mbps connection can exhaust tens of gigabytes of RAM within seconds, forcing the server to allocate it and then preventing its release. "A home computer on a 100Mbps connection can render a vulnerable server inaccessible within seconds. Against Apache httpd and Envoy, a single client can consume and hold 32GB of server memory in roughly 20 seconds," the researchers say.
How the Attack Actually Works
Understanding the HTTP/2 Bomb mechanics is essential for building an effective defence. The attack has two distinct stages that work in deadly concert.
Stage 1: The HPACK Compression Bomb
The attack targets HPACK, the HTTP/2 header compression scheme. The attacker seeds the server's dynamic table with a nearly empty header and emits thousands of 1-byte indexed references to it. Because the header is tiny, standard decoded-size limits never fire. However, each 1-byte reference forces the server to create a fresh per-entry bookkeeping allocation, causing massive memory amplification — up to 5,700:1.
This is a clever bypass of existing defences.
Unlike earlier HPACK compression bombs, which relied on expanding large compressed values, the new technique exploits memory consumed by server-side header processing and bookkeeping. As a result, common limits on decoded header size do not stop the attack.
Stage 2: The Slowloris-Style Memory Hold
After forcing the server to allocate memory, the attacker prevents those resources from being released by abusing HTTP/2 flow-control mechanisms, causing memory consumption to continuously increase.
A 70:1 amplifier is harmless if the memory is freed when the request completes. It becomes an attack because HTTP/2 lets the client hold the connection open almost for free, pinning every allocated byte for as long as they like.
It's also worth noting how AI played a pivotal role in discovering this chain.
Both halves have been public for a decade. "What Codex did was read the codebases, recognize that the two compose, and build the combined attack. That combination is obvious once you see it, and yet as far as we can tell no human had put it together against these servers," Calif notes.
Why Telcos and Healthcare Organisations Face the Highest Risk
Not every organisation faces equal exposure. Telecommunications providers and healthcare networks are in a particularly vulnerable position for several interconnected reasons.
Scale of HTTP/2 adoption.
The affected products power a significant portion of the web. nginx and Apache are among the most widely deployed web servers, IIS remains common in enterprise environments, while Envoy and Pingora are widely used in cloud and proxy infrastructure.
Telcos and healthcare systems — with their sprawling, complex infrastructure — are heavy users of all of these platforms.
Default configurations are the problem.
CVE-2026-49975 is a remote denial-of-service exploit against most major web servers, including nginx, Apache httpd, Microsoft IIS, Envoy, and Cloudflare Pingora. The vulnerable behaviour exists in each server's default HTTP/2 configuration. This issue may allow a remote attacker to consume excessive server resources when HTTP/2 is enabled, potentially causing service degradation or temporary unavailability.
Healthcare and telecom environments frequently run default configurations due to legacy system constraints and complex change-management processes.
Traditional DDoS protection won't catch it.
Traditional volumetric DDoS protections may not detect the attack because it targets server resource allocation rather than network capacity.
Organisations that rely on legacy perimeter defences — common in heavily regulated sectors — are blind to this attack vector.
Operational consequences are severe. For healthcare providers, a web server crash is not merely an IT inconvenience: patient portals, clinical APIs, pharmacy systems, and emergency communication tools may all go offline. For telcos, the ripple effects of service degradation can cascade across customers, regulators, and emergency services that depend on their networks.
Industries such as healthcare, telecommunications, finance, and government services bore the brunt of major cyber attacks, with critical infrastructure and sensitive data at risk.
The threat landscape is already active.
Shortly after the CVE-2026-49975 disclosure, Imperva reported that attackers in the wild were "running specialized tools designed to map out" vulnerable servers.
The reconnaissance phase is already underway.
The Scale of Vulnerable Infrastructure
The numbers are sobering.
What stands out most of all about HTTP/2 Bomb is the sheer scale of vulnerable online infrastructure. Calif's initial Shodan scan indicated that more than 880,000 websites support HTTP/2 and run one of the vulnerable types of servers: nginx, Apache httpd, Microsoft IIS, Envoy, and Cloudflare Pingora.
A working proof-of-concept (PoC) is publicly available, "And it's easy to run. On the attacker side, you don't need a lot of resources to pull it off."
The low barrier to entry is what transforms this from a theoretical concern into an urgent operational risk.
The patch rollout has also been uneven across vendors.
Nginx and Apache fixed the issue before public disclosure, and Envoy released its fix the day after publication. Microsoft took an extra week, releasing its mitigation on Patch Tuesday.
Systems can still be exposed in 2026 if they run vulnerable default HTTP/2 configurations, especially on products that had not yet been patched at the time of the report, including Microsoft IIS, Envoy, and Cloudflare Pingora.
Practical Mitigation Tips You Can Act On Right Now
The good news is that effective defences exist, and many can be deployed immediately. Here is a prioritised action plan for security and infrastructure teams.
1. Patch Your Web Servers Without Delay
This is the single most critical step.
The problem was fixed in nginx version 1.29.8, which added a max_headers directive, and on Apache httpd mod_http2 2.0.41, where the issue was assigned the identifier CVE-2026-49975.
If you can't upgrade nginx, disable HTTP/2 with http2 off;.
For Apache, apply mod_http2 v2.0.41; otherwise, set Protocols http/1.1 to disable HTTP/2 entirely.
2. Audit Your Exposed HTTP/2 Endpoints
Web operators should verify whether HTTP/2 is enabled on exposed server instances and monitor vendor advisories from nginx, Apache, Microsoft, Envoy, and Cloudflare for patch availability.
Use Shodan or your own asset inventory to identify externally facing servers running default HTTP/2 configurations.
3. Deploy or Verify Your WAF Configuration
Cloud WAF automatically inspects and manages anomalous stream and frame structures at the edge, mitigating malicious HPACK anomalies before they reach backend services. For organisations utilising WAF-GW protecting environments where HTTP/2 is enabled, administrators should take immediate action to verify that HTTP/2 Header Restrictions are actively applied and enforced within their security policies.
4. Front Vulnerable Servers with a Reverse Proxy or CDN
Systems running behind CDNs or reverse proxies do not expose the vulnerable HTTP/2 endpoint and are more difficult to target. Some deployments may already have custom header-count limits, WAFs, reverse proxies, or HTTP/2 disabled.
If patching is delayed, this is the most effective compensating control available.
5. Cap Per-Worker Memory at the OS Level
For all servers, cap per-worker memory via cgroups, ulimit -v, or container limits — an OOM-killed worker that respawns is a far better failure mode than a machine pushed into swap.
This limits the blast radius even if an attacker successfully initiates the bomb.
6. Implement Rate Limits on HTTP/2 Control Frames
Patching, tighter control-frame handling, and rate limits are the most effective immediate defences.
Regularly updating and maintaining IP blocklists to block traffic from known botnets is a fundamental security practice. Blocking traffic from participating HTTP/2 attackers during the attack can substantially mitigate the threat.
7. Improve Observability and Anomaly Detection
Visibility matters: correlate proxy and origin metrics with network telemetry to catch the pattern early and automate response.
Closely monitor connection statistics, including the number of active streams, stream creation rate, and stream cancellation rate. Identify abusive HTTP/2 connections and implement business logic to assess the usefulness of each connection based on factors such as request content and client behaviour.
Conclusion: Act Now Before the Threat Becomes Operational
The HTTP/2 Bomb is a stark reminder of how AI is fundamentally reshaping the vulnerability discovery landscape — enabling researchers (and eventually threat actors) to identify complex attack chains that eluded human analysis for a decade.
Vulnerabilities like CVE-2026-49975 highlight the volatility of the modern threat landscape and show that relying solely on patching backend applications leaves a dangerous window of exposure.
For telcos and healthcare organisations, the stakes are simply too high to adopt a wait-and-see approach. A successful HTTP/2 Bomb strike doesn't just generate downtime — it can silence patient-facing systems, disrupt emergency communications, and erode the public trust that both sectors depend on.
Is your infrastructure protected against CVE-2026-49975? Now is the time to audit your HTTP/2 exposure, validate your WAF policies, and confirm your patch status across every affected vendor. If you need expert guidance on hardening your web infrastructure against Layer 7 DoS threats, contact our security team today for a rapid vulnerability assessment — before attackers complete their reconnaissance and strike first.
