Web Server Security

CVE-2026-49975 combines HPACK compression abuse with Slowloris-style holds to exhaust 32GB of server memory in 10 seconds. nginx and Apache patched; IIS, Envoy remain exposed.

Security researchers disclose nginx-poolslip, an unpatched zero-day in NGINX 1.31.0 that defeats ASLR protection. Millions of servers at risk with no CVE or fix available yet.