🏠IT之家•Stalecollected in 10m
New HTTP/2 Bomb DoS attack exploits server memory
💡Critical security vulnerability affecting major web servers; learn how to protect your infrastructure.
⚡ 30-Second TL;DR
What Changed
Attack exploits HPACK dynamic table and flow control stalling
Why It Matters
This vulnerability poses a significant risk to web infrastructure, potentially allowing a single client to take down high-performance servers. Organizations should prioritize patching or implementing protective proxy configurations.
What To Do Next
Audit your web server configurations and consider disabling HTTP/2 or deploying a WAF to limit request header counts if you are using affected software.
Who should care:Developers & AI Engineers
Key Points
- •Attack exploits HPACK dynamic table and flow control stalling
- •Can exhaust 32GB of RAM in approximately 10-18 seconds
- •Affects NGINX, Apache, IIS, Envoy, and Cloudflare Pingora
🧠 Deep Insight
Web-grounded analysis with 8 cited sources.
🔑 Enhanced Key Takeaways
- •The 'HTTP/2 Bomb' attack uniquely combines two previously known HTTP/2 vulnerabilities: HPACK compression amplification and a Slowloris-style resource retention via HTTP/2 flow-control stalling.
- •This novel combination allows the attack to bypass existing server defenses, such as limits on total decoded header size, by exploiting per-entry bookkeeping memory allocation rather than the decoded content itself.
- •A single client with a 100 Mbps connection can rapidly consume tens of gigabytes of server RAM, with Envoy and Apache httpd exhibiting the highest memory amplification ratios at approximately 5,700:1 and 4,000:1, respectively.
- •The exploit was discovered by OpenAI's Codex, which identified how to chain these two techniques after analyzing server codebases, demonstrating AI's capability in uncovering complex vulnerabilities.
- •Immediate mitigations for affected servers include upgrading NGINX to version 1.29.8 or later (which introduces a
max_headersdirective), updating Apache httpd to mod_http2 v2.0.41 (or httpd 2.4.67 for CVE-2026-23918), or disabling HTTP/2 if patches are not yet available.
🛠️ Technical Deep Dive
- HPACK Compression Amplification: HTTP/2's HPACK is a stateful header compression scheme where both client and server maintain a dynamic table of recently seen headers. An attacker exploits this by inserting a small header into the dynamic table and then repeatedly referencing it using a single-byte index. The server, upon receiving these compact references, is forced to materialize and allocate a full copy of the header in memory for each reference, leading to significant memory amplification.
- Slowloris-style Flow Control Stalling: The second component of the attack prevents the server from freeing the memory allocated by the HPACK bomb. This is achieved by the attacker advertising a zero-byte flow-control window. This action prevents the server from completing its response and thus from deallocating the memory. To keep the connection alive and prevent timeouts, the attacker periodically sends tiny
WINDOW_UPDATEframes, effectively pinning the allocated memory indefinitely. - Defense Evasion: Unlike classic compression bombs that stuff large values into the table, this variant focuses on the per-entry bookkeeping memory allocated by the server for each header reference, bypassing defenses that only cap the total decoded header size.
- Impact: A single client can achieve high memory consumption rates, for instance, consuming 32GB of server memory in approximately 10-18 seconds against vulnerable Apache httpd and Envoy instances.
🔮 Future ImplicationsAI analysis grounded in cited sources
AI-driven vulnerability discovery will become a standard practice in cybersecurity.
The successful discovery of the 'HTTP/2 Bomb' by OpenAI's Codex, chaining known techniques, demonstrates AI's advanced capability in identifying complex, previously overlooked exploits, pushing towards more automated and sophisticated vulnerability research.
Web server and protocol developers will need to adopt more stringent resource management and specification interpretations for HTTP/2 and future protocols.
The attack highlights a gap in HTTP/2 specifications regarding memory risk, necessitating server implementations to enforce hard caps on header counts and manage the lifetime of stalled streams more effectively, beyond just decoded header size limits.
The security of AI development environments and supply chains will become a critical focus for organizations.
The involvement of OpenAI Codex in the attack's discovery, coupled with recent reports of supply chain attacks targeting AI development tools, indicates that these environments are emerging as high-value targets for attackers.
⏳ Timeline
2015-05
HTTP/2 protocol (RFC 7540) is standardized.
2016-01
Early HTTP/2 DoS vulnerabilities, including HPACK Bomb (CVE-2016-6581) and Slow Read (CVE-2016-8740, CVE-2016-1546), are disclosed, representing techniques later chained in the 'HTTP/2 Bomb'.
2023-10
The HTTP/2 'Rapid Reset' attack (CVE-2023-44487) is widely exploited, demonstrating significant HTTP/2 DoS capabilities.
2026-04
NGINX is privately notified of the 'HTTP/2 Bomb' vulnerability and releases patch 1.29.8, which includes a `max_headers` directive.
2026-05-27
Apache is privately notified of the 'HTTP/2 Bomb' and releases a fix in mod_http2 v2.0.41, assigned CVE-2026-49975.
2026-06-02
The 'HTTP/2 Bomb' attack, discovered by OpenAI's Codex, is publicly disclosed by security firm Calif.
2026-06-03
Envoy releases patches to mitigate the 'HTTP/2 Bomb' attack.
📎 Sources (8)
Factual claims are grounded in the sources below. Forward-looking analysis is AI-generated interpretation.
📰
Weekly AI Recap
Read this week's curated digest of top AI events →
👉Related Updates
AI-curated news aggregator. All content rights belong to original publishers.
Original source: IT之家 ↗