A newly disclosed HTTP/2 vulnerability is enabling unauthenticated attackers to crash servers by triggering memory exhaustion conditions. The security flaw affects multiple HTTP/2 implementations that fail to properly manage resource consumption when handling stalled data flows, allowing threat actors to degrade or completely disrupt services.
HTTP/2, defined in RFC 9113, is widely deployed to enhance web performance through multiplexing, header compression, and flow control mechanisms. Flow control specifically prevents endpoints from overwhelming each other by limiting data transmission before receiving acknowledgment. However, researchers have discovered this legitimate protocol feature can be weaponized when improperly implemented.
How Does the Attack Mechanism Work?
The vulnerability emerges when malicious clients intentionally manipulate flow-control parameters to stall outbound data transmission. Attackers can set values like SETTINGS_INITIAL_WINDOW_SIZE to zero or withhold WINDOW_UPDATE frames, effectively preventing servers from sending response data. In affected implementations, servers continue processing incoming requests and generating full responses despite being unable to transmit them to clients.
According to CERT/CC, response data accumulates in memory buffers for each stalled stream. Attackers rapidly increase memory usage by opening multiple streams and requesting large resources until connections time out or terminate. This creates a memory amplification condition where relatively small attacker requests result in disproportionately large memory consumption on targeted servers.
What Systems Are Affected?
Security researchers from the Okta Red Team, who reported the issue, demonstrated this behavior can be exploited remotely without authentication. In high-resource environments, the attack can trigger out-of-memory conditions, kernel OOM kills, or severe swap thrashing, potentially rendering systems completely unresponsive. Even in restricted configurations, attackers can exhaust worker threads or connection pools, preventing legitimate users from accessing services.
The vulnerability has been assigned multiple CVEs, including CVE-2026-44909, CVE-2026-59173, and CVE-2026-59762, reflecting its impact across different vendors and implementations. Affected vendors include Apache Traffic Server, Citrix, F5 Networks, Meta, Red Hat, SUSE, and Yahoo. Some providers such as Cloudflare and AMD have confirmed they are not affected.
How Can Organizations Protect Themselves?
This issue highlights a broader class of protocol-level weaknesses where legitimate features become weaponized for denial-of-service attacks. Unlike traditional volumetric DDoS attacks, this technique relies on protocol abuse and efficient resource exhaustion, making it harder to detect using standard traffic filtering mechanisms.
Vendors have begun releasing patches and mitigation guidance. Recommended defenses include enforcing strict memory limits for buffered responses, limiting the number of concurrent HTTP/2 streams per connection, and actively terminating connections exhibiting stalled flow-control behavior. Proper timeout handling and backpressure mechanisms can also reduce exposure.
Organizations running HTTP/2-enabled services are strongly advised to review vendor advisories and apply updates immediately. Monitoring for abnormal memory usage patterns and unusual HTTP/2 stream behavior can help detect exploitation attempts in real time.
Source: Cybersecurity News