2 verified briefings on Http/2. Each story includes a plain-English summary, why it matters, and the concrete action engineering teams should take.
A flaw in the popular nginx web server allows attackers to cause a denial of service using a specially crafted cookie. This can take websites and applications offline, requiring an immediate patch to prevent outages.
A new remote denial-of-service vulnerability, named HTTP/2 Bomb, affects major web servers including NGINX, Apache, Microsoft IIS, Envoy, and Cloudflare. The flaw exists in the default HTTP/2 configuration of these servers, making them susceptible to attack without any special setup, according to researchers.