https://seclists.org/oss-sec/2026/q2/790: HTTP/2 Bomb affects Apache httpd, nginx, envoy, & pingora
Published Jun 3, 2026
·Updated
Affected Software
5 affected components
Nginx nginx<1.29.8
Apache Apache httpd mod_http2<2.0.41
Microsoft IIS
Envoy Envoy
Cloudflare Pingora
Frequently Asked Questions
1
What is the severity of HTTP/2 Bomb vulnerability?
The HTTP/2 Bomb vulnerability poses a high severity risk as it can lead to a remote denial-of-service against major web servers.
2
How do I fix HTTP/2 Bomb vulnerability?
To fix the HTTP/2 Bomb vulnerability, configure your web server to limit HTTP/2 stream processing and apply any available security patches from your server provider.
3
Which web servers are affected by the HTTP/2 Bomb vulnerability?
The HTTP/2 Bomb vulnerability affects Apache httpd, Nginx, Microsoft IIS, Envoy, and Cloudflare Pingora.
4
How can HTTP/2 Bomb exploit be identified?
The HTTP/2 Bomb exploit can often be identified by monitoring unusual server performance, such as unresponsive behavior or crashing under load.
5
Is there a mitigation strategy for the HTTP/2 Bomb vulnerability?
Yes, mitigating the HTTP/2 Bomb vulnerability involves controlling resource limits and investigating server configurations to enhance overall security.