Critical HTTP/2 Flaw Affects Servers

A new remote denial-of-service vulnerability, dubbed HTTP/2 Bomb, affects major web servers like NGINX and Apache in their default configurations.

Cybersecurity researchers have identified a critical remote denial-of-service (DoS) vulnerability affecting the HTTP/2 protocol. Dubbed the "HTTP/2 Bomb," this exploit can be used by a remote attacker to crash major web servers, disrupting service for users. The flaw was discovered by OpenAI Codex and impacts a wide range of popular server software, including NGINX, Apache HTTPD, Microsoft IIS, Envoy, and Cloudflare's Pingora. According to the researchers, the vulnerability is present in the default HTTP/2 configuration of these servers, meaning many systems are susceptible without any custom or unusual setups. This makes the potential attack surface incredibly large across the web.

The significance of this vulnerability lies in its broad impact on core internet infrastructure. NGINX, Apache, and IIS collectively power a vast majority of the world's websites and web applications. Because the exploit works against default settings, countless servers are likely vulnerable right now without administrators needing to have enabled any special features. A successful DoS attack can render services completely unavailable, leading to significant downtime, loss of revenue, and damage to a company's reputation. This type of attack consumes server resources until they are exhausted, causing a crash or making the server unresponsive to legitimate traffic.

This vulnerability affects the default configurations of the most widely used web servers, including NGINX, Apache, and IIS. This means a huge portion of the internet's infrastructure is potentially exposed to denial-of-service attacks, which can take websites and applications offline.

A successful exploit can lead to significant service downtime, resulting in direct revenue loss, reputational damage, and a poor user experience. The widespread nature of the vulnerability means businesses of all sizes could be at risk if their web infrastructure is not updated.