HTTP/2 Bomb threatens 880k servers with memory draining DoS

The article discusses a critical security threat known as the HTTP/2 Bomb exploit, recently disclosed by the security firm Calif. This exploit targets vulnerabilities in modern web server configurations, enabling attackers to induce denial-of-service conditions by consuming vast amounts of server memory. The technique utilizes a combination of historical methods, leading to substantial memory amplification and making traditional defense mechanisms ineffective.

Affected systems include widely-used servers like Apache, NGINX, and others, exposing more than 880,000 public web portals. Remediation efforts are ongoing, with some platforms already implementing patches. Recommended defensive strategies include reverting to HTTP/1.1 and enforcing strict resource constraints to mitigate the attack's impact.