A newly disclosed remote denial-of-service exploit dubbed \u201cHTTP\/2 Bomb\u201d targets the default HTTP\/2<\/a> configurations of the world\u2019s most widely deployed web servers, nginx, Apache httpd, Microsoft IIS, Envoy, and Cloudflare Pingora, enabling a single attacker on a home internet connection to exhaust tens of gigabytes of server memory in seconds.<\/p>\n The exploit was discovered by researcher Quang Luong using Codex and chaining two techniques that have individually been known to the security community for nearly a decade: an HPACK compression bomb and a Slowloris-style connection hold.<\/p>\n What makes this variant novel is not the primitives themselves, but the precise way they are combined and, critically, where the amplification originates.<\/p>\n HPACK (RFC 7541<\/a>) is HTTP\/2\u2019s stateful header compression scheme. Each peer maintains a dynamic table of recently seen headers; a sender can insert a header once and subsequently reference it with a single-byte index.<\/p>\n The receiver must materialize a full copy of that header on every reference. According to Jun Rong and Duc Phan,\u00a0the exploit seeds the dynamic table with one header, then emits thousands of 1-byte indexed references in a single request, costing the attacker one wire byte while forcing the server to allocate anywhere from ~70 bytes (nginx, IIS, Pingora) to ~4,000 bytes (Apache httpd, Envoy) per reference.<\/p>\n The second component exploits HTTP\/2 per-stream flow control (RFC 9113<\/a>). The client advertises a zero-byte flow-control window, preventing the server from ever finishing its response.<\/p>\n A trickle of 1-byte HTTP\/2 Bomb Remote DoS Exploit<\/strong><\/h2>\n
WINDOW_UPDATE<\/code> frames continuously resets the send timeout, pinning every memory allocation in place for as long as the attacker wishes turning a transient amplification into a persistent memory hold.<\/p>\n![\"Attack](\"https:\/\/i0.wp.com\/substackcdn.com\/image\/fetch\/%2524s_%21b5uX%21%2Cw_1456%2Cc_limit%2Cf_webp%2Cq_auto%3Agood%2Cfl_progressive%3Asteep\/https%253A%252F%252Fsubstack-post-media.s3.amazonaws.com%252Fpublic%252Fimages%252F5ca91bca-3d08-428c-aed2-64a4b18bdd63_1920x1080.gif?ssl=1\")