Codex Discovered a Hidden HTTP/2 Bomb

We’re publishing HTTP/2 Bomb, a remote denial-of-service exploit against most major web servers, including: nginx Apache httpd Microsoft IIS Envoy Cloudflare Pingora The vulnerable behavior exists in each server's default HTTP/2 configuration. The attack was discovered by Codex, which chained two techniques known to humans for a decade: a compression bomb and a Slowloris-style hold. The bomb targe

[nilab]

"We’re publishing HTTP/2 Bomb, a remote denial-of-service exploit against most major web servers" "We disclosed to Apache on May 27, and Stefan Eissing fixed it on the same day by making cookie headers count against LimitRequestFields. The issue was assigned CVE-2026-49975."

[strawberryhunter]

テストした5つの実装で横断的に脆弱性があったと。「But when five independent implementations all read that section and still ship the same class of bug, the defect is in the spec.」そうね。

[misshiki]

CodexがHTTP/2 Bombを発見。HPACKの1-byte indexed referenceとzero-byte flow-control windowを組み合わせ、nginx、Apache、IIS、Envoy、PingoraでDoSを誘発。ApacheではCVE-2026-49975。

[aosiro]

こんなんいっぱいあるんやろな

[nguyen-oi]

人間が10年間気づかなかったゼロデイの組み合わせをAIが発見したの、地味にセキュリティ界のパラダイムシフトでは。パッチ当てなきゃ

[pekee-nuee-nuee]

もー最近セキュリティ更新多すぎてだるすぎ😩