A flaw in the HTTP/2 implementation allows a remote attacker to cause a denial of service (DoS) by inducing excessive memory allocation. The attack, dubbed the HTTP/2 Bomb, combines HPACK compression amplification with flow-control stalling. An attacker can insert a header into the HPACK dynamic table and reference it repeatedly using a compact indexed representation, creating a loop that requires increasing memory. Simultaneously, the attacker uses a zero-byte flow-control window to prevent the server from freeing this memory, periodically sending `WINDOW UPDATE` frames to avoid timeouts. This allows a single low-bandwidth connection to exhaust server memory rapidly, rendering the server inaccessible. In Apache HTTP Server, this issue specifically affects the `mod http` and `mod http2` modules. In nginx, the issue relates to the incorrect handling of certain cookie headers in the HTTP/2 implementation.