CVE-2026-49975: HTTP/2 Bomb Attack Can Knock Web Servers Offline in Seconds

**Executive summary:** CVE-2026-49975 (the "HTTP/2 Bomb") is a denial-of-service chain that combines an HPACK compression bomb with HTTP/2 flow-control/continuation-frame abuse to cause rapid memory exhaustion and take major web servers offline; vendors including NGINX and Apache have released fixes while others (Microsoft IIS, Envoy, Cloudflare Pingora) were unpatched at the time of reporting, and defenders should prioritize patching exposed HTTP/2 services and monitoring for abnormal memory spikes and abrupt service degradation.