Last Updated: 2026-06-03T21:27:00Z
What’s Happening
Another model-discovered vulnerability can shut down most HTTP servers, including Nginx and Apache.
Proofs of concept available on GitHub.
Actions
Apply available patches:
| Server | Vulnerable? | Patched Version(s) |
|---|---|---|
| Nginx | Yes | 1.29.8 |
| Apache | Yes | Fixed in mod_http2 v2.0.41 |
| Envoy | Yes | 1.35.11, 1.36.7, 1.37.3, 1.38.1 |
| IIS | Yes | Unknown |
| Cloudflare Pingora | Yes | Unknown |
| Caddy | Unknown | Unknown |
Mitigate:
Cap per-worker memory (cgroups, ulimit -v, container limit, etc.)
(Also recommended generally for defense in depth / future vulnerabilities)
Notes
Envoy has patched.