Protecting against HTTP/2 Bomb vulnerability (CVE-2026-49975) with HAProxy

CVE-2026-49975 is a critical resource-exhaustion vulnerability affecting major web servers including NGINX, Apache HTTPD, and Microsoft IIS, where a single home computer on a 100 Mbps connection can take a vulnerable server offline in seconds by exploiting HPACK header compression through massive memory amplification. HAProxy is architecturally safe from being overwhelmed by this exploit due to its strict memory constraints, though users can also implement optional mitigations using stick tables and protocol monitoring to reject malicious connections before they reach backend servers. The HTTP/2 Bomb attack uses a two-stage approach: first seeding the server’s dynamic table and emitting thousands of tiny indexed references, then using flow-control tactics to hold allocations indefinitely.