Mitigate CVE-2026-49975 - HTTP/2 HPACK Bomb in Contour/Envoy

Products

VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

An unauthenticated remote attacker can exploit CVE-2026-49975 by sending a crafted HTTP/2 request containing a malicious HPACK-encoded header block (an "HPACK Bomb") directly to the vRA nodes. The decompressed headers consume excessive memory in the Envoy proxy, causing denial of service.

Environment

Aria Automation 8.18.x

Cause

Contour/Envoy accepts HTTP/2 connections by default. The HPACK compression algorithm allows a small compressed payload to expand to a very large header set. When such a payload is delivered over HTTP/2, Envoy exhausts available memory before it can enforce size limits.

Resolution

VMware By Broadcom is aware of CVE-2026-49975.

A resolution will be included in future software releases. Please monitor the release notes of both current and upcoming product versions for specific updates regarding this vulnerability.

Workaround

This patch mitigates the vulnerability by creating a custom profile that configures Contour to accept only HTTP/1.1 connections, which eliminates the HTTP/2 attack surface on the Aria Automation nodes.

NOTE: If theAria Automation nodes are placed behind a firewall or load balancer and are not directly reachable by untrusted clients, the attack is not exploitable and this patch may not be required.

WARNING: After this patch is applied HTTP/2 will be disabled for all services fronted by Contour. Clients that only support HTTP/2 (and not HTTP/1.1) will not be able to connect. Ensure that all clients in your environment support HTTP/1.1 before applying this patch.

===========
Install patch
===========

1. Take simultaneous VM snapshots without memory of all Aria Automation nodes.

2. Execute the following command on only one of the Aria Automationnodes in order to create the custom profile on all nodes:

vracli cluster exec -- bash -c 'base64 -d <<< 'IyEvYmluL2Jhc2gKIyBDb3B5cmlnaHQgKGMpIDIwMjYgQnJvYWRjb20uIEFsbCBSaWdodHMgUmVzZXJ2ZWQuCiMgQnJvYWRjb20gQ29uZmlkZW50aWFsLiBUaGUgdGVybSAiQnJvYWRjb20iIHJlZmVycyB0byBCcm9hZGNvbSBJbmMuCiMgYW5kL29yIGl0cyBzdWJzaWRpYXJpZXMuCgpoPSQoaG9zdG5hbWUpCmxvZygpIHsKICAgIGVjaG8gIlskMV1bJChkYXRlICIrJVktJW0tJWQtJUgtJU0tJVMiKV1bJGhdICQyIiA+JjIKfQoKbG9nIElORk8gIkNyZWF0aW5nIHByb2ZpbGUgZGlyZWN0b3J5Igpta2RpciAtcCAvZXRjL3Ztd2FyZS1wcmVsdWRlL3Byb2ZpbGVzL2NvbnRvdXItZGlzYWJsZS1odHRwMi12Y2Zjb24tNTkwNTYvaGVsbS9wcmVsdWRlX2NvbnRvdXIvCmxvZyBJTkZPICJQcm9maWxlIGRpcmVjdG9yeSBjcmVhdGVkIgoKbG9nIElORk8gIkNyZWF0aW5nIGNoZWNrIGZpbGUiCmNhdCA8PEVPRiA+IC9ldGMvdm13YXJlLXByZWx1ZGUvcHJvZmlsZXMvY29udG91ci1kaXNhYmxlLWh0dHAyLXZjZmNvbi01OTA1Ni9jaGVjawojIS9iaW4vYmFzaApleGl0IDAKRU9GCmNobW9kIDc1NSAvZXRjL3Ztd2FyZS1wcmVsdWRlL3Byb2ZpbGVzL2NvbnRvdXItZGlzYWJsZS1odHRwMi12Y2Zjb24tNTkwNTYvY2hlY2sKbG9nIElORk8gImNoZWNrIGZpbGUgY3JlYXRlZCIKCiMgT25seSB0aGUgbmV3IGNvbmZpZ0lubGluZSBrZXkgaXMgbmVlZGVkIGhlcmU7IEhlbG0gZGVlcC1tZXJnZXMgbWFwIHZhbHVlcyBzbyB0aGUKIyBleGlzdGluZyBjb25maWdJbmxpbmUgc2V0dGluZ3MgaW4gdmFsdWVzLnlhbWwgYXJlIHByZXNlcnZlZC4KbG9nIElORk8gIkNyZWF0aW5nIHByb2ZpbGUgcmVzb3VyY2VzIGZpbGUiCmNhdCA8PEVPRiA+IC9ldGMvdm13YXJlLXByZWx1ZGUvcHJvZmlsZXMvY29udG91ci1kaXNhYmxlLWh0dHAyLXZjZmNvbi01OTA1Ni9oZWxtL3ByZWx1ZGVfY29udG91ci85Mi1kaXNhYmxlLWh0dHAyLnlhbWwKY29uZmlnSW5saW5lOgogIGRlZmF1bHQtaHR0cC12ZXJzaW9uczoKICAgIC0gIkhUVFAvMS4xIgpFT0YKY2htb2QgNjQ0IC9ldGMvdm13YXJlLXByZWx1ZGUvcHJvZmlsZXMvY29udG91ci1kaXNhYmxlLWh0dHAyLXZjZmNvbi01OTA1Ni9oZWxtL3ByZWx1ZGVfY29udG91ci85Mi1kaXNhYmxlLWh0dHAyLnlhbWwKbG9nIElORk8gIlByb2ZpbGUgcmVzb3VyY2VzIGZpbGUgY3JlYXRlZCIK' | bash -'

3. Execute the following script on only one of the Aria Automation nodes to apply the custom profile configuration (requires downtime):

/opt/scripts/deploy.sh

Note: The custom profile configuration is preserved during upgrades.

=============
Rollback patch
=============

1. Remove the custom profile from all nodes (run on one node):

vracli cluster exec -- bash -c 'rm -rf /etc/vmware-prelude/profiles/contour-disable-http2-vcfcon-59056'

2. Redeploy services (run on one of the nodes):

/opt/scripts/deploy.sh

===========
Verification
===========

To verify the patch has been applied, check the profile exists on all nodes:

vracli cluster exec -- bash -c 'cat /etc/vmware-prelude/profiles/contour-disable-http2-vcfcon-59056/helm/prelude_contour/92-disable-http2.yaml'

The output should show (repeated for each node in case of HA):

configInline:
     default-http-versions:
       - "HTTP/1.1"