CERT/CC disclosed a critical HTTP/2 flow-control vulnerability allowing unauthenticated attackers to exhaust server memory via crafted requests,
The U.S. Computer Emergency Readiness Team Coordination Center (CERT/CC) issued an advisory on July 16, revealing that some HTTP/2 server implementations contain a critical flow-control vulnerability. This flaw allows unauthenticated remote attackers to send crafted HTTP requests, exhausting server memory resources and triggering a Denial of Service (DoS) attack[1]. The vulnerability was discovered and reported by Okta's red team and affects major vendors including the Apache Traffic Server project, Citrix, F5, Meta, Red Hat, SUSE Linux, and Yahoo[1]. Multiple vendors have released updates or mitigations for affected versions; users should immediately verify their patch status per the advisory[1].
The core mechanisms of the HTTP/2 protocol include Multiplexing, header compression, and flow control, designed to regulate data transfer between browsers and servers[1]. The flow-control mechanism relies on the window size advertised by the client (e.g., SETTINGS_INITIAL_WINDOW_SIZE) to determine the maximum data volume the server can send, preventing receiver overload[1]. The technical root of this vulnerability lies in the server's failure to adequately limit buffer memory consumption when responding to client requests[1].
Attackers can exploit standard client flow-control parameters by deliberately advertising SETTINGS_INITIAL_WINDOW_SIZE = 0 or manipulating WINDOW_UPDATE frames to stall outbound data[1]. In vulnerable HTTP/2 implementations, the server continues processing requests and generating full responses even when data cannot be transmitted; the response data remains buffered[1]. Each stalled stream consumes buffer space until the connection closes or a timeout occurs[1].
By opening multiple simultaneous streams and requesting large files, attackers cause the server buffer to accumulate massive amounts of response data. In environments with permissive resource limits, this can lead to memory exhaustion (OOM), severe swap thrashing, service instability, and in extreme cases, full system crashes[1]. Even under conservative configurations, the attack exhausts worker processes or connection resources, significantly degrading service availability[1].
This vulnerability affects multiple mainstream HTTP/2 servers and load-balancing products. The CVE identifiers for each product are as follows:
Without timely patching, affected systems face high risks of memory exhaustion, service interruption, and system crashes, causing severe operational disruption for enterprises[1].
The primary measure to reduce the risk of such attacks is to enforce memory ceilings, limit concurrent stream counts, and actively terminate stalled connections[1]. Specific mitigation recommendations per product are as follows:
For Apache Traffic Server, upgrade to the patched version (9.1.14+ or 10.1.3+)[1][2].
For F5 BIG-IP and other web servers, update per vendor advisories[1].
For Citrix Netscaler, configure a responder policy on virtual servers using HTTP/2 to limit the number of requests per TCP connection, and set the maxClients parameter to limit TCP connections[6].
If immediate patching is not feasible, CERT/CC recommends temporarily disabling HTTP/2 support; while this may reduce performance, it effectively eliminates the attack surface[5][8].