HTTP/2 Bomb DoS Attack

General Discussions
1

New HTTP/2 Bomb DoS Attack Hits Nginx, Apache, IIS, Envoy, and Pingora

A new HTTP/2 Bomb DoS attack can exhaust memory on major web servers, causing denial-of-service in seconds.

The attack uses two techniques. First, it exploits HPACK, HTTP/2’s header compression, by sending small indexed header references that expand into much larger server-side allocations. Second, it leverages HTTP/2 flow control to stall responses, preventing the server from releasing allocated memory.

6 Likes
Weekly Forum Summary
2

Thanks for sharing this, good one to flag. Also see:

Note that anything behind a CDN with a locked-down origin is much harder to hit.

Apache:

Nginx:

3 Likes