‘HTTP/2 Bomb’ Exploit Knocks Web Servers Offline in Seconds
HTTP/2 Bomb exploit chains compression and Slowloris attacks to knock web servers offline in seconds.
Security researchers have discovered HTTP/2 Bomb, a denial-of-service exploit that chains together HPACK compression bombs with Slowloris-style memory exhaustion attacks to rapidly take down major web servers. The attack affects over 880,000 websites running default configurations of NGINX, Apache HTTPD, Microsoft IIS, Envoy, or Cloudflare Pingora and can be launched from a home computer on a 100 Mbps connection. While the underlying techniques are not new (some dating back a decade), the novel combination was identified using OpenAI's Codex and demonstrates how AI can detect previously overlooked attack chains.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft?
Get an email when a new story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe HTTP/2 Bomb exploit demonstrates how default configurations on major web servers can create severe vulnerabilities when combined in unexpected ways. While the individual attack techniques (HPACK compression bombs and Slowloris attacks) have been known for years, their novel combination creates a devastating denial-of-service capability that affects over 880,000 websites. This highlights the critical importance of hardening web server configurations beyond default settings and maintaining awareness of how seemingly separate vulnerabilities can be chained together. The fact that AI tools helped identify this attack chain also shows the evolving threat landscape where automated discovery of complex exploit combinations is becoming more accessible to attackers.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Web application firewall and DDoS protection
Websites and APIs stay up, and common web attacks are filtered before they reach them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2016-6581
- cve — CVE-2025-53020
- cve — CVE-2016-8740
- cve — CVE-2016-1546
- cve — CVE-2026-49975