🤚 The Open-Palm Incident Report

A new denial-of-service attack called the “HTTP/2 Bomb” can crash a web server with 32 gigabytes of RAM in under ten seconds using a single machine on a 100 Mbps connection. The technique was discovered by OpenAI’s Codex software agent under the guidance of researchers at offensive security firm Calif, because apparently we’ve reached the stage of civilization where AI finds the vulnerabilities, AI writes the exploit code, and the human researcher’s job is to name it something dramatic and schedule a conference talk.

The attack combines two previously known HTTP/2 weaknesses into a hybrid that is significantly worse than either one alone:

• HPACK Compression Amplification: The attacker inserts a header into the dynamic table and then references it thousands of times via compact indexed representation — as small as one byte per reference. This creates memory amplification ratios of 5,700:1 on Envoy and 4,000:1 on Apache httpd.
• Flow Control Stalling: The attacker advertises a zero-byte flow-control window, which prevents the server from releasing allocated memory. The server sends periodic WINDOW_UPDATE frames to avoid timeouts, but the requests never complete and the memory just accumulates, like unread emails from your compliance department.

👐 The Two-Handed Server Autopsy

The damage report reads like a server room obituary:

• Envoy 1.37.2: 32 GB RAM exhausted in ~10 seconds
• Apache httpd 2.4.67: 32 GB RAM exhausted in ~18 seconds
• nginx 1.29.7: 32 GB RAM exhausted in ~45 seconds
• IIS (Windows Server 2025): 64 GB RAM exhausted in ~45 seconds
• Cloudflare Pingora: Also vulnerable, timeline unspecified, presumably because Cloudflare is still workshopping the blog post

That’s every major web server platform on Earth, taken down by a single connection. Not a botnet. Not a distributed attack. One machine, one connection, and the polite fiction that your infrastructure can handle the modern internet dissolves in approximately the time it takes to brew a cup of coffee.

Apache httpd has been assigned CVE-2026-49975. Patches exist for nginx 1.29.8+ (via a new max_headers directive) and Apache mod_http2 2.0.41+. For IIS, Envoy, and Pingora, there are currently no patches — only “mitigation recommendations,” which is the security industry’s way of saying “good luck, turn off HTTP/2, and maybe stand behind a CDN.”

🌿 The Gentle Awakening

Let us pause to appreciate the full absurdity of the situation. HTTP/2 was designed to make the web faster. Its header compression system, HPACK, was specifically engineered to reduce overhead. And now that same compression system is being weaponized to create a 5,700-to-one memory amplification ratio that can disable a production server before a human operator can even alt-tab to the monitoring dashboard.

The protocol specification included flow control precisely to prevent resource exhaustion. The flow control mechanism is now the attack vector. The safety feature is the weapon. This is the networking equivalent of discovering that your seatbelt is also a garrote.

And the vulnerability was found by an AI coding agent. OpenAI’s Codex — the same family of models that autocompletes your JavaScript — identified the interaction between two known weaknesses and synthesized them into something novel and devastating. Researcher Quang Luong will present the full details at the Real World AI Security conference later this month, but the proof-of-concept exploit code is already on GitHub under Calif’s publications repository, because responsible disclosure now comes with a complimentary GitHub release.

👑 The Gold-Leaf Infrastructure Reckoning

This is the third major HTTP/2 vulnerability in recent memory, following Rapid Reset in 2023 and CONTINUATION Flood in 2024. At this point, HTTP/2’s security track record is less “battle-tested protocol” and more “recurring subscription to the CVE database.” The protocol was ratified in 2015 and has been accumulating novel attack surfaces ever since, which raises the uncomfortable question of whether the performance gains of multiplexed streams and header compression are worth the expanding catalog of ways a single attacker can consume all of your server’s memory.

HTTP/3 and QUIC solve some of these problems by moving transport to UDP, but adoption remains patchy and the migration path is neither simple nor cheap. For now, the practical advice is: patch immediately if you’re running Apache or nginx, implement strict header-count limits at your proxy layer, and seriously consider whether every endpoint needs HTTP/2 enabled at all. The mitigation for the unpatched platforms — “disable HTTP/2 where feasible” — is technically correct but operationally equivalent to telling someone to avoid the ocean because of sharks.

Meanwhile, the fact that an AI agent discovered this vulnerability is both impressive and deeply concerning in equal measure. If Codex can find novel protocol-level denial-of-service attacks by combining known techniques, then the vulnerability research landscape just acquired an automated participant with no sleep schedule and no conference fees. The defenders get the same tools, of course. But the defenders have to patch every server. The attacker only needs one exploit.

“The protocol designed to make the internet faster now makes servers crash faster. The vulnerability was found by an AI. The exploit is on GitHub. The patch covers two out of five platforms. Everything is proceeding exactly as the threat model predicted, and the threat model was written by a chatbot.” — The Slap of Wisdom Infrastructure Resilience Division, filing this report from a server that has been downgraded to HTTP/1.1, thank you very much