#http2

Analysis · Jul 5, 2026 · Colten Anderson

One HTTP/2 bug, three CVE numbers, and the patch you'll miss

The HTTP/2 Bomb fragments into at least three CVEs plus an unnumbered nginx fix. Search the wrong one and you'll conclude your edge is safe when a slice of it isn't.