05.06.20TT.VE; which is used for the processing of the current HTTP-processing system only; HTTP-processing-processing-processing-processing-processing-processing-processing-processing-processing-processing-processing-processing-processing-processing-processing-processing-processing-processing-processing-processing-processing-processing-processing-processing-processing-processing-processing-processing-processing-processing-processing-processing-processing-processing-processing-processing-processing-processing-processing-processing-processing-processing Security-resistance and CV-TTU: Inc. - Inc. - Inc. - Inc. - Inc. - Inc. - Inc. - Inc. - Inc. - Inc. - Inc. - Inc. - Inc. - Inc. - Inc. - Inc. - Inc. - Inc. - Inc. - Inc. - Inc. - Inc. - Inc. - Inc. - Inc. - Inc. - Inc. - Inc. - Inc. - Inc. - Inc. - Inc. - Inc. - Inc. - Inc. - Inc. - Inc. - Inc. - Inc. - Inc. - Inc. - Inc. - Inc. - Inc. - Inc. - Inc. - Inc. - Inc. - Inc. - Inc. - Inc. - Inc. - Inc. - Inc. - Inc. - Inc. - Inc. - Inc. - Inc. - Inc. - Inc. - Inc. - Inc For all public HTTP/HTTPS-services it is recommended to use the maximum HTTP/HTTP Application Load Balancer and the maximum HTTP/HTTPS-services to protect the public as a single public entry point, so that incoming traffic to the latter mods is only permitted by the balancer and the trusted internal networks. For the HTTP/HTTPS-services it is preferable to use the L7-services to ensure the security of the Internet, if the maximum balance of the virtual decode, the ApTT/HTTPS-services are not available, so that the incoming traffic to the Kubo-services is only permitted by the balancer and the trusted internal networks. For HTTP/HTTPS-services it is preferable to use the HTTP/ nginx processors, correction added in nginx 1.29.8; 27.05.2026 - vulnerability passed to Apache, correction made in mod_http2 2.0.41; 02.06.2026 - original report Calif "Codex Discovered a Hidden HTTP/2 Bomb"; 03.06.2026 - published advisory Envoy GHSA-22m2-hvr2-xqc8 / CVE-2026-47774 and corrected versions of Envoy; 05.06.2026 - published Yandex Cloud bulletin. Impact on Yandex Cloud services {#impact-on-yandex-cloud-services-CVE-2026-499} Yandex Cloud services are updated to prevent the ability to operate the vulnerability. The vulnerability does not affect the privacy or integrity of user data servers. Users are recommended when the Pingpoint
05.06.2026 — CVE-2026-49975 HTTP/2 Bomb — удаленный отказ в обслуживании в реализациях HTTP/2 {#CVE-2026-49975}
05.06.2026 — CVE-2026-49975 HTTP/2 Bomb — удаленный отказ в обслуживании в реализациях HTTP/2 {#CVE-2026-49975} Идентификатор CVE (CVE ID): CVE-2026-49975 Дополнительный идентификатор: CVE-2026-47774 — уязвимость в Envoy. Ссылка на CVE: <https://www.cve.org/CVERecord?id=CVE-2026-49975> На момент публикации карточка NIST NVD для CVE-2026-49975 публично не создана. CVE присвоен CNA, запись на cve.org находится в статусе Reserved и будет обновлена после публикации данных. Исходный отчет {#original-report-CVE-2026-49975} Codex Discovered a Hidden HTTP/2 Bomb: <https://blog.calif.io/p/codex-discovered-a-hidden-http2-bomb> PoC и материалы исследования: <https://github.com/califio/publications/tree/main/MADBugs/http2-bomb> Патч NGINX, директива max_headers: <https://github.com/nginx/nginx/commit/