HTTP/2 Vulnerability Allows Denial-of-Service via Memory Exhaustion
A newly disclosed vulnerability in multiple HTTP/2 implementations allows unauthenticated attackers to crash servers through memory exhaustion attacks by manipulating stalled data flows.
A critical denial-of-service (DoS) vulnerability affecting numerous HTTP/2 implementations has been disclosed, enabling unauthenticated attackers to crash vulnerable servers by exploiting memory exhaustion. The flaw stems from improper handling of stalled data flows, a core component of HTTP/2 designed for efficient web communication. By manipulating flow-control parameters, attackers can prevent servers from sending response data, leading to a rapid accumulation of data in memory buffers.
The vulnerability, detailed by researchers from the Okta Red Team, allows malicious clients to intentionally stall outbound data transmission. This is achieved by setting parameters like SETTINGS_INITIAL_WINDOW_SIZE to zero or by withholding necessary WINDOW_UPDATE frames. In affected systems, the server continues to process incoming requests and generate responses, but cannot transmit them, causing memory buffers to fill up. This condition, known as memory amplification, allows relatively small attacker requests to consume disproportionately large amounts of server memory.
Multiple CVEs have been assigned to this vulnerability, including CVE-2026-44909, CVE-2026-59173, and CVE-2026-59762, reflecting its widespread impact across various vendors and software versions. Notable affected vendors include Apache Traffic Server, Citrix, F5 Networks, Meta, Red Hat, SUSE, and Yahoo. Some organizations, such as Cloudflare and AMD, have confirmed their systems are not susceptible to this particular flaw.
Exploitation can lead to severe consequences, ranging from out-of-memory conditions and kernel OOM kills to significant swap thrashing, rendering systems unresponsive. In less severe configurations, attackers can still exhaust worker threads or connection pools, effectively denying service to legitimate users. The attack's unauthenticated nature and reliance on protocol abuse make it particularly insidious, as it can bypass traditional volumetric DDoS mitigation techniques.
Vendors are actively releasing patches and providing mitigation guidance to address the vulnerability. Recommended defenses include implementing strict memory limits for buffered responses, capping the number of concurrent HTTP/2 streams per connection, and actively terminating connections exhibiting stalled flow-control behavior. Robust timeout handling and backpressure mechanisms are also crucial for reducing exposure.
This vulnerability underscores a broader class of security weaknesses where legitimate protocol features can be weaponized for malicious purposes. As HTTP/2 is fundamental to modern web performance and infrastructure, ensuring its robust and secure implementation is paramount. Organizations are strongly advised to review vendor advisories and apply necessary updates promptly to protect their services from these denial-of-service attacks.
Monitoring for unusual memory usage patterns and abnormal HTTP/2 stream activity can also serve as an early warning system for potential exploitation attempts. The ongoing discovery of such protocol-level vulnerabilities highlights the continuous need for vigilance and proactive security measures in web infrastructure.