A newly disclosed HTTP/2 denial-of-service vulnerability is raising concerns across the cybersecurity community after researchers confirmed that unauthenticated attackers can crash vulnerable servers by triggering memory exhaustion conditions.
The issue affects multiple HTTP/2 implementations that fail to manage resource consumption properly when handling stalled data flows, enabling attackers to degrade or completely disrupt services.
HTTP/2, defined in RFC 9113, is widely used to improve web performance through multiplexing, header compression, and flow control.
Flow control is a key mechanism designed to prevent endpoints from overwhelming each other by limiting how much data can be sent before receiving acknowledgment. However, this same mechanism can be abused when improperly implemented.
HTTP/2 Flaw Crashes Servers
The vulnerability arises when a malicious client intentionally manipulates flow-control parameters to stall outbound data transmission. By setting values such as SETTINGS_INITIAL_WINDOW_SIZE to zero or by withholding WINDOW_UPDATE frames, the attacker effectively prevents the server from sending response data.
In affected implementations, the server continues to process incoming requests and generate full responses even though it cannot transmit them to the client.
According to CERT/CC, response data accumulates in memory buffers for each stalled stream, allowing attackers to rapidly increase memory usage by opening multiple streams and requesting large resources until connections time out or are terminated.
This leads to a condition known as memory amplification, where relatively small attacker requests result in disproportionately large memory consumption on the server.
Security researchers from the Okta Red Team, who reported the issue, demonstrated that this behavior can be exploited remotely without authentication. In high-resource environments, the attack can trigger out-of-memory conditions, kernel OOM kills, or severe swap thrashing, potentially rendering systems unresponsive.
Even in more restricted configurations, attackers can exhaust worker threads or connection pools, preventing legitimate users from accessing services.
The vulnerability has been assigned multiple CVEs, including CVE-2026-44909, CVE-2026-59173, and CVE-2026-59762, reflecting its impact across different vendors and implementations.
Affected vendors include Apache Traffic Server, Citrix, F5 Networks, Meta, Red Hat, SUSE, and Yahoo. Some providers, such as Cloudflare and AMD, have confirmed they are not affected.
This issue highlights a broader class of protocol-level weaknesses where legitimate features can be weaponized for denial-of-service attacks. Unlike traditional volumetric DDoS attacks, this technique relies on protocol abuse and efficient resource exhaustion, making it harder to detect using standard traffic filtering mechanisms.
Vendors have begun releasing patches and mitigation guidance. Recommended defenses include enforcing strict memory limits for buffered responses, limiting the number of concurrent HTTP/2 streams per connection, and actively terminating connections that exhibit stalled flow-control behavior. Proper timeout handling and backpressure mechanisms can also help reduce exposure.
Organizations running HTTP/2-enabled services are strongly advised to review vendor advisories and apply updates as soon as possible. Monitoring for abnormal memory usage patterns and unusual HTTP/2 stream behavior can also help detect exploitation attempts in real time.
As HTTP/2 remains a critical component of modern web infrastructure, this vulnerability underscores the importance of robust implementation safeguards to prevent protocol features from being turned into attack vectors.
