> Source: [sk185066](https://support.checkpoint.com/results/sk/sk185066)

# sk185066 - Check Point Response to CVE-2026-49975 (HTTP/2 Bomb) 

| Property | Value |
|----------|-------|
| Solution ID | sk185066 |
| Date Created | 2026-06-16 |
| Last Modified | 2026-06-16 |
| Technical Level | General |
| Products | WAF Application Security |
| Versions | Cloud |

## Symptoms

- A recently disclosed Denial-of-Service vulnerability, [CVE-2026-49975](https://access.redhat.com/security/cve/cve-2026-49975) (HTTP/2 Bomb), targets HTTP/2 request processing by exploiting the resource overhead associated with requests containing an excessive number of HTTP headers.

This attack can cause disproportionate CPU and memory consumption and potentially lead to service degradation or Denial-of-Service conditions in affected environments.

The attack abuses HTTP/2 request processing by sending requests with an unusually large number of headers, forcing excessive resource allocation on the receiving system.

Environments are most susceptible when:

* HTTP/2 traffic reaches applications directly.
* Header count limitations are not enforced.
* Resource consumption scales with header volume.

## Solution

**There is no Impact on Check Point WAF Deployments.**

* Check Point WAF SaaS deployments are protected. Customers leveraging integrated CDN capabilities benefit from an additional mitigation layer, as HTTP/2 connections are terminated before traffic reaches the protected application environment.

* Check Point WAF Gateway, Unified Container, and Agent Deployments are protected. For managed Check Point WAF deployments, HTTP/2 traffic is terminated at the WAF layer and is not forwarded directly to protected applications. As a result, backend applications are not exposed to the vulnerable attack surface.

Existing Protection Mechanisms
------------------------------

Check Point WAF already incorporates multiple controls that reduce exposure to HTTP/2 resource exhaustion attacks, including:

* Request size limitations

* Header size enforcement

* Layer 7 Distributed Denial of Service protections

* Resource consumption safeguards

Additional Hardening: Header Count Limiting
-------------------------------------------

As an additional defense-in-depth measure, Check Point is introducing a configurable **Header Count Limiting control**. This capability allows administrators to define the maximum number of HTTP headers permitted in a single request, helping to:

* Prevent excessive header proliferation

* Limit resource consumption per request

* Reduce exposure to HTTP/2 Bomb-style attacks

* Improve resilience against malformed requests

Customer Guidance
-----------------

**No immediate customer action is required for Check Point-managed WAF deployments.**

Customers should maintain current releases and apply newly released header-count protection controls when they become available.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content