TLDR Tech / InfoSec
Codex Discovered a Hidden HTTP/2 Bomb
Calif disclosed HTTP/2 Bomb, a remote denial-of-service attack against nginx, Apache httpd, Microsoft IIS, Envoy, and Cloudflare Pingora in their default HTTP/2 configurations, discovered by OpenAI's Codex, chaining two decade-old techniques: an HPACK indexed-reference bomb where each 1-byte reference forces 70 to 4,000 bytes of server allocation, and a zero-byte flow-control window stall that pins that memory in place, letting a single client hold roughly 32GB on Apache httpd or Envoy in about 20 seconds (assigned CVE-2026-49975 for Apache). The deeper lesson is editorial as much as technical, since RFC 7541 framed HPACK memory risk purely as an amplification ratio while ignoring that HTTP/2 lets a client pin allocations cheaply, so five independent implementations read the same guidance and shipped the same bug class. Defenders should upgrade nginx to 1.29.8+ for the max_headers directive, apply Apache's mod_http2 v2.0.41 fix, disable HTTP/2 where no patch exists for IIS, Envoy, and Pingora, and cap per-worker memory so a bombed process is OOM-killed before dragging the host into swap.
Read the full story