HTTP/2 flow-control flaw enables server DoS
A HTTP/2 flow-control abuse technique lets unauthenticated attackers exhaust server memory in Apache Traffic Server, Citrix NetScaler, F5 BIG-IP, and Meta implementations.
Sourcekb.cert.org — open the original
What to check
- Applies to
- The 3 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT/CC disclosed a denial-of-service vulnerability affecting multiple HTTP/2 server implementations that fail to properly bound memory when clients stall flow control. By setting SETTINGS_INITIAL_WINDOW_SIZE to zero or withholding WINDOW_UPDATE frames while opening many concurrent streams requesting large resources, a remote unauthenticated attacker can force servers to buffer large amounts of unsendable response data, leading to memory exhaustion, swap thrashing, and potential crashes or worker/connection starvation.
Confirmed affected implementations include Apache Traffic Server (CVE-2026-59173, fixed in 9.2.14/10.1.3 via hard enforcement of stream limits with REFUSED_STREAM), Citrix NetScaler ADC/Gateway when HTTP/2 is enabled, F5 BIG-IP (CVE-2026-59762), and Meta (CVE-2026-44909). Citrix requires both an upgrade and manual configuration of the new Http2SmallWndTimeout parameter for non-Strict HTTP Profiles to fully remediate. Numerous other vendors (Cloudflare, Fastly, GitHub, BIND, HAProxy, nghttp2, Tempesta, and others) reported they are not affected due to conservative buffer or timeout limits, while a large number of vendors have not yet issued statements.
The issue is conceptually related to prior HTTP/2 DoS classes such as Data Dribble (CVE-2019-9511). The IETF HTTP Working Group noted the underlying RFC 9113 specification is not at fault, placing responsibility on individual implementations that fail to enforce memory ceilings, concurrent stream limits, and stalled-connection timeouts. Organizations running affected HTTP/2 servers should apply vendor patches and configure resource limits to mitigate exposure.
Mentioned in this report
Source reporting: https://kb.cert.org/vuls/id/885548
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs