HTTP/2 DoS Vulnerability Lets Attackers Exhaust Server Memory via Stalled Flow Control
Do Son 
A newly disclosed HTTP/2 DoS vulnerability affects several server implementations at once. A remote, unauthenticated attacker can crash or freeze a server by abusing normal flow-control settings. The flaw lets an attacker force the server to buffer response data it cannot send, which drains memory fast.
TL;DR
Multiple HTTP/2 servers mishandle stalled flow control. As a result, attackers can trigger memory exhaustion and denial-of-service. CERT/CC tracks the issue, and vendors including F5 and Apache Traffic Server have shipped fixes.
Why it matters
HTTP/2 runs a large share of modern web traffic. Therefore, a shared design weakness can hit many products together. This HTTP/2 DoS vulnerability needs no login and no special access. One attacker with a single connection can degrade or down a service.
How the attack works
Flow control keeps a sender from overwhelming a receiver. Clients advertise a window size to cap in-transit data. However, a client can stall that flow on purpose. It can withhold WINDOW_UPDATE frames or advertise an initial window size of zero.
Some servers keep generating full response bodies anyway. Because the data cannot leave, it stays buffered in memory. Each stalled stream holds its buffer until the connection closes or times out. An attacker then opens many streams and requests large resources. Consequently, buffered data piles up until memory runs out.
Affected versions
The issue spans several vendors, each with its own CVE. F5 BIG-IP is affected under CVE-2026-59762, rated CVSSv4 8.7, as a data-plane-only issue. Apache Traffic Server is affected under CVE-2026-59173 (CVSS 7.5), covering 9.0.0 through 9.1.13 and 10.0.0 through 10.1.2. The advisory also lists CVE-2026-44909 among the tracked cases. Check each vendor advisory for exact affected builds.
Patch and mitigation steps
Update to the fixed releases as vendors publish them. For Apache Traffic Server, upgrade to 9.1.14 or 10.1.3. For BIG-IP and other products, follow the vendor’s guidance for your version.
Configuration hardening helps, too. Enforce memory ceilings for buffered response data. Restrict the number of concurrent streams per connection. Also, terminate stalled connections quickly. For the coordinated advisory and the full vendor list, see the CERT/CC advisory on the HTTP/2 flow-control DoS.
No public exploitation has been confirmed at this time. Still, the low barrier to abuse makes prompt patching the safer choice.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
