HTTP/2 Bomb CVE-2026-49975: AI Is Rewriting Vuln Hunting

The HTTP/2 Bomb (CVE-2026-49975), disclosed June 2, 2026, lets a single home connection on 100 Mbps exhaust the memory of more than 880,000 websites running default HTTP/2 on NGINX, Apache, IIS, Envoy, or Cloudflare Pingora. A parallel Microsoft flaw, CVE-2026-49160, was partly credited to OpenAI’s Codex — the clearest signal yet that LLMs are now finding protocol-level weaknesses, not just application bugs.

The HTTP/2 Bomb, Explained

CVE-2026-49975 is not a single new bug. It is a chain of long-known HTTP/2 denial-of-service primitives stitched into one devastating attack, discovered by researcher Quang Luong at Calif Security Research and disclosed on June 2, 2026. SecurityWeek, cited by SOC Prime, demonstrated the exploit knocking major web servers offline within seconds from a home machine.

The chain has two stages. The first reuses the HPACK Bomb concept (originally CVE-2016-6581), which abuses HTTP/2 header compression so that tiny wire messages decompress into enormous memory structures on the target. Against Apache, researchers demonstrated a 4,000x amplification rate last year — addressed then in version 2.4.64 as CVE-2025-53020. The second stage layers Slowloris-style behavior (CVE-2016-8740 and CVE-2016-1546) on top: the attacker advertises a zero-byte flow-control window, stalls the response, and pins the inflated memory allocations in place instead of letting the server free them.

The genuinely novel twist, as Calif explained to SecurityWeek, is that the amplification does not come from a large decoded header value. It comes from the per-entry bookkeeping the server allocates around nearly empty headers. Traditional decoded-size limits therefore fail to stop the attack, because there is “almost nothing to decode.” That detail is what makes this flaw dangerous: the mitigations many teams already built for CVE-2025-53020 do not apply here.

Why Default Configs Are the Target

The Bomb succeeds precisely because default HTTP/2 configurations were never hardened against this combination. Cybersecurity News documented the Apache-specific path in detail: when multiple cookie header fields arrive, Apache merges them without counting them against the LimitRequestFields directive, silently bypassing a key resource guard. An attacker crafts a small HPACK-encoded request that decompresses into a flood of cookie fields, sets the initial window size to zero to stall transmission, then drip-feeds one byte every two seconds to keep streams artificially alive for up to 300 seconds. Memory climbs steeply and stays pinned for the entire hold.

All Apache HTTP Server versions from 2.4.17 through 2.4.67 are vulnerable, with the fix landing in Apache 2.4.68. Patches are also available for NGINX. Microsoft IIS, however, remains unpatched at the time of writing — and disabling HTTP/2 is, for now, the only complete mitigation for IIS-fronted workloads. Proof-of-concept code is already public on GitHub, packaged as a Python script reproducible against a Dockerized target with an 8 GB memory limit.

CVE-2026-49160: When Codex Finds the Flaw

The Bomb is a human researcher’s work, but sitting in the same June Patch Tuesday is a sibling vulnerability that points at where this whole field is heading. CVE-2026-49160 is another HTTP/2 denial-of-service flaw — and Microsoft’s advisory credits both a third-party research firm and OpenAI’s Codex with the discovery. Microsoft rates exploitation as “more likely,” warning that it leads to uncontrolled resource consumption over a network.

The credit line matters more than the CVSS. It is the clearest mainstream confirmation that LLMs are now actively probing not just individual applications but the standards on which software rests — RFC 7540 and 9113 in this case. Rapid7’s Adam Barnett put it plainly: this class of vulnerability “is likely to expand further as researchers use advances in LLM capability to probe not just specific software, but also the standards on which software rests.”

The Patch Volume Problem

AI-assisted discovery is already flooding the pipeline. Microsoft shipped 200 vulnerabilities in June 2026 Patch Tuesday and, separately, 360 browser vulnerabilities — an order of magnitude more than any month in the past several years, according to Rapid7. The volume grew so large that Microsoft stopped enumerating Chromium CVEs in the Security Update Guide entirely. Linux kernel vulnerability counts are climbing on the same curve, driven by the same AI-assisted reporting.

This is the operational reality senior practitioners have to internalize: the constraint is no longer finding bugs, it is triaging them. When a home machine can generate a CVE that disables 880,000 sites, and an LLM can grind protocol RFCs for new amplification primitives overnight, the mean time between disclosure and public PoC collapses. The window between “patch available” and “exploit in the wild” is narrowing toward zero, and several of last month’s Patch Tuesday flaws landed on CISA’s KEV catalog within days of release — the same compressed window that turned the SolarWinds Serv-U DoS flaw into a mass-exploitation event.

What to Do This Week

Treat the HTTP/2 Bomb as a priority-one web-tier exposure, not a backlog item. The patch is available and the PoC is live.

• Patch Apache immediately to 2.4.68+ on every internet-facing host. Inventory any 2.4.17–2.4.67 build still in rotation — it is vulnerable by default.
• Apply the NGINX update and tune http2_max_concurrent_streams, http2_recv_timeout, and header buffer limits. Defaults are the attack surface — the same default-trust posture that made the recent nginx-ui two-request takeover trivial.
• For IIS, disable HTTP/2 on public endpoints until Microsoft ships a fix. HTTP/1.1 over TLS is the safe fallback for the window this flaw is unpatched.
• Instrument memory on web-server containers and processes. Sustained memory growth with low CPU and low bandwidth is the signature of an HPACK-Bomb-style hold.
• Review WAF and CDN posture. Imperva reports its customers are protected via custom rules; confirm your CDN or edge is applying equivalent HTTP/2 stream and header controls, not just volumetric DDoS scrubbing.
• Raise your patch cadence assumption. If your SLA for web-tier CVEs is measured in weeks, this month’s 360 browser CVEs and the AI-discovered HTTP/2 flaw make that SLA a liability. Move critical-protocol flaws to a 72-hour standard.

Standards Are the New Attack Surface

For a decade, the blue-team orthodoxy was that protocol-level bugs were rare, slow-moving, and usually caught by the IETF or by big-vendor fuzzing programs. That assumption is now obsolete — a shift the Microsoft Defender exploit wave already foreshadowed for the endpoint tier. An LLM with an RFC and a fuzz harness can enumerate compression-amplification and flow-control primitives across every implementation of a standard faster than any vendor can ship coordinated patches. The Bomb proves the primitives were always there, dormant, waiting to be chained — and the Codex credit on CVE-2026-49160 proves the tool that finds them is now commodity infrastructure.

The strategic implication is uncomfortable but clear: default configurations are assumptions, and assumptions are the attacker’s advantage. Every HTTP/2 deployment running a vendor default is now a standing bet that nobody has chained its primitives yet. Patch Apache and NGINX, disable HTTP/2 on IIS, and start treating protocol RFCs the way you treat npm dependencies — as continuously re-examined attack surface, not settled ground.

References

• Rapid7 — Patch Tuesday June 2026: HTTP/2 DoS, PowerToys EoP, Nightmare Eclipse disclosures
• SOC Prime — CVE-2026-49975: HTTP/2 Bomb Attack Can Knock Web Servers Offline in Seconds
• Cybersecurity News — PoC Exploit Released for HTTP/2 Bomb Remote DoS Vulnerability in Apache HTTP Server
• GitHub — CVE-2026-49975 PoC (mrx-arafat)
• Imperva — Imperva Customers Protected Against CVE-2026-49975 HTTP/2 Bomb
• Help AG — Top Middle East Cyber Threats, 08 June 2026
• CISA — Known Exploited Vulnerabilities Catalog