Full Report
Codex drops an HTTP/2 Bomb
Analysis Summary
# Tool/Technique: HTTP/2 Bomb
## Overview
The **HTTP/2 Bomb** is a remote denial-of-service (DoS) attack technique discovered by security researchers at Calif via the OpenAI Codex agent. It chains two decade-old vulnerabilities—the **HPACK compression bomb** and **Slowloris-style connection holding**—to exhaust server memory. The attack allows a single machine with modest bandwidth (e.g., 100Mbps) to crash major web servers within seconds by forcing massive memory allocations.
## Technical Details
- **Type**: Denial-of-Service (DoS) Technique
- **Platform**: Web servers supporting HTTP/2 (nginx, Apache HTTP Server, Microsoft IIS, Envoy, Cloudflare Pingora)
- **Capabilities**: Memory exhaustion, service disruption, remote crash.
- **First Seen**: Discovered/Publicized June 2026.
## MITRE ATT&CK Mapping
- **TA0040 - Impact**
- **T1498 - Network Denial of Service**
- **T1498.001 - Reflection/Amplification** (via HPACK compression)
- **T1499 - Endpoint Denial of Service**
- **T1499.002 - Service Exhaustion** (Memory exhaustion)
## Functionality
### Core Capabilities
- **HPACK Compression Bomb (CVE-2016-6581):** Exploits the HPACK algorithm used in HTTP/2 to compress headers. By sending many tiny packets that decompress into large header sets, the attacker forces the server to allocate vast amounts of RAM.
- **Slowloris-Style Hold:** Utilizes techniques similar to CVE-2016-8740 to keep legitimate connections open for as long as possible.
- **Resource Exhaustion:** Combined, these techniques prevent the server from releasing the memory allocated to the "bombed" headers, leading to a crash or total unresponsiveness.
### Advanced Features
- **AI-Assisted Discovery:** The technique was identifies by an AI agent (Codex) by analyzing codebases and recognizing how two distinct historic vulnerabilities could be chained effectively.
- **High Efficiency:** A single client can force a server (such as Apache or Envoy) to consume 32GB of memory in approximately 20 seconds using only a 100Mbps connection.
## Indicators of Compromise
- **File Hashes (PoC Exploit):** Check the [Calif GitHub repository](https://github.com/califio/publications/tree/main/MADBugs/http2-bomb) for current PoC script iterations.
- **Network Indicators:**
- Rapid influx of HTTP/2 frames from a single IP address.
- Large volumes of `HEADERS` frames containing highly compressed data.
- **Behavioral Indicators:**
- Sudden, exponential spikes in RAM usage (e.g., 32GB in <30 seconds) on web server processes (e.g., `httpd`, `nginx`).
- High number of persistent, long-duration HTTP/2 connections from single sources.
## Associated Threat Actors
- No specific APT groups named; however, the exploit was discovered by **Calif** researchers and is currently available as a Proof-of-Concept (PoC) for red teaming and research purposes.
## Detection Methods
- **Behavioral Detection:** Monitor for "asymmetric" memory growth—where small inbound network traffic results in massive memory allocation by the web service.
- **Protocol Analysis:** Detect non-standard HTTP/2 behavior, such as an excessive number of headers or extremely long-lived connections that do not transmit data after the initial handshake.
- **Alerting:** Set thresholds for the number of concurrent open HTTP/2 streams per client.
## Mitigation Strategies
- **Patching:**
- **nginx:** Upgrade to version 1.29.8 or later (utilize `max_headers` directive).
- **Apache:** Update to `mod_http2` v2.0.41 or later (CVE-2026-49975).
- **Envoy:** Apply latest security patches released in June 2026.
- **Configuration Hardening:**
- Enforce a strict cap on the maximum number of HTTP headers a client can send.
- Implement aggressive timeouts for idle HTTP/2 connections.
- **Disabling Features:** If a patch is unavailable (e.g., for specific versions of IIS or Pingora), consider disabling HTTP/2 support until mitigations are applied.
## Related Tools/Techniques
- **Slowloris:** The original slow-connection DoS attack.
- **HPACK Bomb:** The 2016 vulnerability focusing on header compression.
- **Rapid Reset (CVE-2023-44487):** Another high-profile HTTP/2-based DoS technique.