Notice of the HTTP/2 Bomb Remote DoS Vulnerability (CVE-2026-49975)
A critical vulnerability, known as HTTP/2 Bomb, has been disclosed in the HTTP/2 protocol. It results from a design flaw in the combination of the HPACK compression and flow control systems. Attackers can exploit this vulnerability remotely without authentication, using very little bandwidth. The attack exhausts server memory and makes services unavailable.
Description
| Type | CVE-ID | Severity | Discovered |
|---|---|---|---|
| Denial of service | Critical | 2026-06-03 |
Impact
The CCE NGINX Ingress Controller and Envoy Gateway add-ons are affected by this vulnerability.
- This vulnerability affects the open-source NGINX Ingress Controller of the following versions:
- ≤ v1.13.9
- ≤ v1.14.5
This vulnerability affects the CCE NGINX Ingress Controller add-on v5.0.15, v6.0.31, and earlier. Refer to NGINX Ingress Controller Release History for the details about the mapping between the CCE NGINX Ingress Controller add-on and open-source versions.
- This vulnerability affects the open-source Envoy of the following versions:
- ≤ 1.37.2
This vulnerability affects the CCE Envoy Gateway add-on v1.0.9 and earlier. Refer to Envoy Gateway Add-on Release History for the details about the mapping between the CCE Envoy Gateway add-on and open-source versions.
Identification Method
Go to Add-ons and check the versions of the installed NGINX Ingress Controller and Envoy Gateway add-ons.
- NGINX Ingress Controller: If the add-on version is v5.0.15, v6.0.31, or earlier, the vulnerability exists. Figure 1 Checking the version of the installed NGINX Ingress Controller add-on
- Envoy Gateway: If the add-on version is v1.0.9 or earlier, the vulnerability exists. Figure 2 Checking the version of the installed Envoy Gateway add-on
Mitigation
NGINX Ingress Controller
Before fixing this vulnerability, grant only the permissions for creating and managing ingresses to trusted users based on the principle of least privilege. For details, see Namespace Permissions (Kubernetes RBAC-based).
If a service does not use HTTP/2, you can update the ConfigMap of NGINX Ingress Controller to disable HTTP/2. The steps are as follows:
- Log in to the CCE console, go to Add-ons, find the installed NGINX Ingress Controller add-on, and click Manage.
- On the Installed Add-ons tab, locate the row containing the instance and click Edit.
- Locate Nginx Parameters, click YAML, add "use-http2": "false" to the JSON file, and click Next.
- After the add-on check is complete, click OK to submit the update.
Envoy Gateway
In Envoy Gateway, downstream connections are controlled by ClientTrafficPolicy. If a service does not use HTTP/2, you can change the ClientTrafficPolicy configuration to disable HTTP/2. The steps are as follows:
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: ClientTrafficPolicy
metadata:
name: disable-http2
spec:
targetRef:
group: gateway.networking.k8s.io
kind: Gateway
name: my-gateway # Replace it with your gateway name.
tls:
alpnProtocols:
- "http/1.1" Copy the configuration, save it to a file, for example, disable-http2.yaml, and apply it in the cluster.
kubectl apply -f disable-http2.yaml
After the vulnerability is fixed, verify that service functions are normal. Do not enable public network access to related services unless necessary.
Solution
CCE will release a new version of the NGINX Ingress Controller add-on that addresses this vulnerability. Keep an eye out for NGINX Ingress Controller Release History.
CCE will release a new version of the Envoy Gateway add-on that addresses this vulnerability. Keep an eye out for Envoy Gateway Add-on Release History.
