HTTP/2 Bomb DoS attack discovered, patches for NGINX, Apache

Cybersecurity researchers have disclosed a new denial-of-service attack technique that can rapidly crash major web servers by exploiting standard features of the HTTP/2 protocol. Dubbed the "HTTP/2 Bomb," the attack can be launched from a single computer on a typical home internet connection and can exhaust a server's memory in seconds.

The vulnerability was identified by researchers at the security firm Calif using OpenAI's Codex software agent, which helped chain together two long-known attack methods. The flaw affects the default HTTP/2 configurations of widely used web servers, including NGINX, Apache HTTP Server, Microsoft IIS, Envoy, and Cloudflare's Pingora. A search indicated nearly 880,000 websites supporting HTTP/2 and running one of these servers, though many may be shielded by intermediary services.

The attack combines a compression amplification technique with a resource retention method. It first abuses HPACK, the header compression mechanism built into HTTP/2. An attacker can craft a request where a single byte of data triggers the server to allocate thousands of bytes of memory for internal bookkeeping. Researchers noted amplification ratios as high as 5,700-to-1...