https://seclists.org/oss-sec/2026/q2/819: HTTP/2 Bomb affects Apache httpd, nginx, envoy, & pingora
Published Jun 4, 2026
·Updated
Affected Software
6 affected components
Envoy Envoy<1.39
h2o h2o<=8dc37cb
Apache HTTP Server
Nginx nginx
Microsoft IIS
Pingora Pingora
Frequently Asked Questions
1
What is the severity of the HTTP/2 Bomb vulnerability affecting Envoy, Apache httpd, Nginx, and others?
The HTTP/2 Bomb vulnerability has been classified with a critical severity due to its potential to cause denial of service across multiple web servers.
2
How do I fix the HTTP/2 Bomb vulnerability in Apache HTTP Server and Nginx?
To fix the HTTP/2 Bomb vulnerability, update your Apache HTTP Server and Nginx to the latest versions that contain the necessary security patches.
3
What versions of Envoy are impacted by the HTTP/2 Bomb vulnerability?
The HTTP/2 Bomb vulnerability affects multiple versions of Envoy prior to the latest security updates released on June 4, 2026.
4
Can the HTTP/2 Bomb vulnerability affect Microsoft IIS?
Yes, the HTTP/2 Bomb vulnerability can affect Microsoft IIS, among other web servers, leading to potential denial of service.
5
Is there an exploit available for the HTTP/2 Bomb vulnerability?
Yes, there are indications that the exploit for the HTTP/2 Bomb vulnerability is accessible due to the publicly disclosed fix commits.