hpack bomb

2026-07-30

HTTP/2 Bomb (CVE-2026-49975): The Industry-Wide Web Server DoS Vulnerability and Why LiteSpeed Customers Are Not Affected

HTTP/2 Bomb (CVE-2026-49975) is a remote denial-of-service vulnerability affecting the default HTTP/2 configurations of NGINX, Apache HTTPD, Microsoft IIS, Envoy, and Cloudflare Pingora. It can crash a web server with 32 GB of memory in roughly 20 seconds from a home internet connection. LiteSpeed Web Server, OpenLiteS