Vulnerabilitymedium
New HTTP/2 Bomb Vulnerability Allows Remote DoS on NGINX, Apache, IIS, Envoy & Cloudflare
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2016-1546 | The Apache HTTP Server 2.4.17 and 2.4.18, when mod_http2 is enabled, does not limit the number of simultaneous stream workers for a single HTTP/2 connection… | 5.9 | 16% | ||
| CVE-2016-6581 | A HTTP/2 implementation built using any version of the Python HPACK library between v1.0.0 and v2.2.0 could be targeted for a denial of service attack… | 7.5 | 2% | ||
| CVE-2016-8740 | The mod_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23, when the Protocols configuration includes h2 or h2c, does not restrict request-header… | 7.5 | 79% | PoC ×2 | |
| CVE-2025-53020 | Late Release of Memory after Effective Lifetime vulnerability in Apache HTTP Server | 7.5 | 5% | ||
| CVE-2026-47774 | Envoy: 1.36.7, 1.37.3, and 1.38.1, a vulnerability in Envoy's HTTP/2 downstream request processing allows an unauthenticated remote… | 7.5 | <1% | PoC | |
| CVE-2026-49160 | HTTP/2 Resource Exhaustion Denial-of-Service in Microsoft Windows and Windows Server | 7.5 | 54% |
From the original article
3 min read at thehackernews.com
Ravie Lakshmanan Jun 03, 2026 Vulnerability / Server Security Cybersecurity researchers have discovered a remote denial-of-service exploit that affects major web servers, including NGINX, Apache HTTPD, Microsoft IIS, Envoy, and Cloudflare Pingora.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.