Vulnerability intelligence
CVE-2026-49160: NGINX, Apache, IIS, Envoy, Pingora denial of service
CVE-2026-49160: Codex agent found an HTTP/2 DoS that crashes NGINX, Apache, IIS, Envoy, and Pingora.
CVSS 7.5
2026
What WebPulse reported · 2 analyses
An AI Agent Found a Protocol-Level Vulnerability That Crashes Web Servers
CVE-2026-49160: Codex agent found an HTTP/2 DoS that crashes NGINX, Apache, IIS, Envoy, and Pingora.
June 22, 2026
The HTTP/2 Bomb: One Client, 32GB of Server Memory, 20 Seconds.
A new denial-of-service technique exploits how every major web server handles HTTP/2 headers. Legacy CMS servers running on tight memory budgets are the easiest
June 11, 2026
Related vulnerabilities