A critical flaw has been detected in the HTTP/2 protocol that allows remote denial-of-service attacks. Popular servers such as NGINX, Apache, IIS, Envoy, and Cloudflare are exposed. Attackers can take websites offline, affecting purchases, transactions, or everyday information. The immediate solution is to apply security patches to prevent outages in essential services.
The flaw exploits stream management in HTTP/2 🔥
The vulnerability lies in how HTTP/2 handles concurrent streams. An attacker sends multiple requests that force the server to consume memory and CPU until it collapses. It affects default configurations in NGINX, Apache, IIS, and Envoy. Cloudflare has already implemented mitigations, but administrators must verify their versions. Without a patch, a single attack can take down a critical service without needing high bandwidth.
Another reason not to sleep soundly as a sysadmin 😅
As if you didn't have enough patching Log4j, SSL, and the kernel every Tuesday, now HTTP/2 gives you a new nightmare. The best part is that the flaw lets you take down your server with less effort than you put into justifying why you didn't update. So you know the drill: coffee, patch, and pray that attackers have better things to do on a Sunday.