‘HTTP/2 Bomb’ Exploit Knocks Web Servers Offline in Seconds
A new ‘HTTP/2 Bomb’ exploit has been discovered that leverages existing vulnerabilities in HTTP/2 implementations to cause widespread denial-of-service attacks against web servers. The exploit combines compression and flow control techniques to overwhelm servers, and was identified by researchers using AI-powered code analysis. This highlights the ongoing risk posed by previously disclosed vulnerabilities and the potential for novel combinations to cause significant disruption.
The ‘HTTP/2 Bomb’ exploit, developed using OpenAI’s Codex, targets common web server configurations including NGINX, Apache HTTPD, Microsoft IIS, Envoy, and Cloudflare Pingora. The attack combines a compression bomb (CVE-2016-6581) with Slowloris-style techniques to exhaust server resources. Researchers at Calif found that the amplification effect, previously addressed in Apache HTTPD versions 2.4.64 (CVE-2025-53020) and later, was significantly enhanced by a new approach focusing on per-entry bookkeeping. While the individual components of the exploit have been known for years, the combination and demonstration of the attack by Codex represents a novel and concerning development. Affected organizations are those running vulnerable versions of these servers, potentially leading to service outages and impacting website availability.