HTTP/2 Bomb — CVE-2026-49975 · Full Disclosure · June 8, 2026
A recently disclosed denial-of-service vulnerability, known as HTTP/2 Bomb (CVE-2026-49975), affects multiple web server implementations.
CVE-2026-49975, also known as HTTP/2 Bomb, is a remote denial-of-service exploit against most major web servers, including nginx, Apache httpd, Microsoft IIS, Envoy, and Cloudflare Pingora.
The vulnerable behavior exists in each server's default HTTP/2 configuration. This issue may allow a remote attacker to consume excessive server resources when HTTP/2 is enabled, potentially causing service degradation or temporary unavailability.
Following disclosure of the vulnerability, we issued a security hotfix to protect customer deployments. This post provides the full technical background and a complete account of our response.
What Is the HTTP/2 Bomb?
The attack chains two features of the HTTP/2 protocol - HPACK header compression and flow-control windows - to exhaust server memory using a single connection and with no authentication required.
One wire byte can result in thousands of bytes allocated on the server, held open indefinitely by periodic zero-window updates from the attacker. A single machine on a standard internet connection can render a vulnerable server inaccessible within seconds.
nginx addressed the issue in version 1.29.8 by introducing a max_headers limit. The fix was released April 2025 but without a formal CVE assignment, which delayed its entry into distribution security trackers.
Our Response Timeline
| Date / Time (UTC) | Event |
|---|---|
| June 2, 2026 — 19:36 | CVE-2026-49975 (HTTP/2 Bomb) published |
| June 3, 2026 — 06:52 ET | Full technical writeup published by Calif detailing the exploit chain |
| June 3, 2026 — 14:30 | 3CX emails Debian security maintainers requesting patch timeline |
| June 4, 2026 | 3CX decision: embed nginx directly into the 3CX build and update process, bypassing Debian packaging dependency. |
| June 5, 2026 | Security hotfix released for Windows and Linux. Hosted instances updated centrally. |
| June 8, 2026 | Debian has pushed nginx hotfix in the debian repositories |
Why We Embedded nginx
3CX Linux deployments have historically relied on the Debian-packaged version of nginx. When this vulnerability was disclosed, the patched version (nginx 1.29.8) was not available in the Debian Bookworm or Trixie repositories.
Rather than rely on an external packaging timeline outside our control, we chose to embed nginx directly into the 3CX installation and update process. This gives us full control over the version of nginx shipped with 3CX, allows us to respond to future vulnerabilities without waiting for distribution maintainers, and ensures all supported platforms receive fixes simultaneously.
If Debian publishes a patched nginx package in future, we will evaluate whether to return to the distribution-packaged approach or continue with the embedded model.
UPDATE: Debian appears to be shipping an update which addresses this vulnerability. However, at this stage we will stick with our customized version of NGINX. This version has been further slimmed down and in case of future vulnerabilities we can provide an immediate response.
Security Update Mechanism Updates
In update 10 we are planning to ship more fine grained security update capabilities. More information to follow.
Who Is Affected and What Action is Required?
Action required
- On-premise or cloud with nginx publicly accessible from the internet you are potentially vulnerable. Apply the hotfix via System > Updates in the Admin Console if you have not done so already.
No immediate action required
- If you are Hosted by 3CX then no customer action is required. The fix was applied centrally before public disclosure of this post.
- On-premise or cloud behind a firewall, nginx not publicly exposed: not reachable from the outside. No immediate action required. Update during your next maintenance window.
Consider 3CX Hosted
The internet is rife with security threats, requiring constant monitoring and frequent updates. If you do not have the capacity to manage this, now is the time to rethink your strategy and consider moving to 3CX Hosted.
As a minimum, we recommend subscribing to 3CX news via our blog page, where we will continue to post important updates. Important system, security, and license-related emails are sent automatically to the email address associated with your 3CX installation. These emails are essential and there is no option to unsubscribe from them. To ensure you receive them, please make sure that emails from 3CX are not being blocked by your mail server, spam filters, or security software, so they do not end up in your spam or junk folder.
You can also follow our Partner and Customer Forums, or social media channels X and LinkedIn for the latest announcements.
