Reported by 1 outlet

Timeline

1. original reporting

   HTTP/2 Bomb — AI-Discovered Chained DoS Exhausts 32 GB Server Memory in Under 60 Seconds

   cyberpress.org · 133d ago · June 3rd, 2026

   A remote denial-of-service exploit dubbed "HTTP/2 Bomb" targets every major web server in their default configurations — nginx, Apache httpd, Microsoft IIS, Envoy, and Cloudflare Pingora — by chaining two decade-old techniques into a devastating amplification attack. Discovered autonomously by OpenAI's Codex, the exploit can render servers inaccessible from a standard residential internet connection.

   Amplification ratios:

   | Server | Amplification | Time to 32 GB |

   |--------|--------------|---------------|

   | Envoy 1.37.2 | ~5,700:1 | ~10 seconds |

   | Apache httpd 2.4.67 | ~4,000:1 | ~18 seconds |

   | nginx 1.29.7 | ~70:1 | ~45 seconds |

   | IIS (Server 2025) | ~68:1 | ~64 GB in ~45s |

   What makes it different: Classic HPACK bombs were mitigated by capping decoded header size. This exploit sidesteps that entirely by abusing RFC 9113's permission to split the Cookie header into one field per crumb — neither Apache nor Envoy was counting crumbs against the field limit. The attack then stalls server responses using zero-byte flow-control windows, pinning the allocated memory indefinitely.

   Mitigations: nginx patches available in 1.29.8+ (max_headers directive). Apache httpd requires standalone mod_http2 v2.0.41. IIS, Envoy, and Pingora have no patches available — organizations must disable HTTP/2 or front with a proxy enforcing per-request header count caps. PoC scripts and Docker labs are publicly available. Shodan identifies 880,000+ exposed endpoints.

   ---