What exactly is CVE-2026-49975, the HTTP/2 Bomb?

It combines two decade-old HTTP/2 flaws into a single remote DoS attack. By exploiting the interaction between HPACK header compression and flow control, an attacker can exhaust ~32GB of server RAM in 20 seconds using just a home laptop.

Why is this vulnerability disclosure considered a paradigm shift?

It knocks out five major web servers in default config without credentials or a botnet. More importantly, an AI discovered it by spotting how two known bad behaviors compose, proving AI-driven code review now surpasses human auditing in complex threat detection.

What should organizations do immediately to mitigate this risk?

Apply patches urgently and tighten server configs: cap maximum header counts, limit HPACK dynamic table sizes, and tune flow control windows. Upgrade WAFs to behavioral analysis, and prepare for AI-generated attack compositions that lower the barrier for advanced threats.

HTTP/2 炸彈（CVE-2026-49975）：HPACK 與流控組合攻擊及補丁方案

兩個各自公開十年的安全漏洞，如今被串聯成一個遠端拒絕服務攻擊，能在預設組態下直接擊垮五大主流 Web 伺服器。攻擊者無需殭屍網路、無需憑證，僅憑一台家用 100Mbps 寬頻的筆記型電腦，就能在約 20 秒內鎖定約 32GB 記憶體。真正值得關注的是，這個漏洞組合由 AI 透過分析程式碼庫發現——它注意到兩個已知有害行為可以組合產生新威脅，而公共基礎建設的漏洞發現正日益依賴 AI 驅動的代码審查。