Codex Publishes HTTP/2 Bomb: Remote DoS Exploit Targeting Major Web Servers

Summary

Codex has discovered and published a remote denial-of-service exploit called "HTTP/2 Bomb" that targets major web servers through their default HTTP/2 configurations. The attack chains two known techniques: a compression bomb exploiting HPACK (HTTP/2's header compression scheme) where one byte on the wire becomes a full header allocation on the server, repeated thousands of times per request, combined with a zero-byte flow-control window that prevents the server from freeing memory. The author notes the irony of having helped break HTTP header compression 14 years ago and reviewed the fix that became part of HTTP/2, yet still missing this attack vector.