A devastating new denial-of-service vulnerability dubbed the “HTTP/2 Bomb” has been publicly disclosed, and it is remarkably effective. Tracked as CVE-2026-49975, the exploit can crash web servers running default HTTP/2 configurations in under a minute — and it affects NGINX, Apache HTTPD, Microsoft IIS, Envoy, and Cloudflare Pingora out of the box. Researchers estimate over 880,000 websites are immediately vulnerable.
The attack combines two techniques into a single devastating payload. First, it abuses HPACK compression amplification — HTTP/2’s header compression scheme — by sending tiny requests that force the server to allocate thousands of bytes of memory through repeated dynamic table references. Second, it holds connections open using a Slowloris-style zero-byte flow-control window, preventing the server from ever freeing that memory. The result: a single client can rapidly exhaust all available server memory.
Perhaps most remarkable is how the exploit was discovered: researchers at Calif used OpenAI’s Codex to identify the vulnerability, marking one of the first high-profile cases of an AI tool uncovering a major infrastructure-level security flaw.
Mitigation
NGINX users should upgrade to version 1.29.8 or newer, which introduces a max_headers directive (defaulting to 1000) to limit header fields per request. If immediate patching isn’t possible, disabling HTTP/2 entirely with http2 off; is the recommended stopgap. Administrators running Apache, IIS, Envoy, and Pingora should consult their respective vendor advisories.
Source
Coverage: SecurityWeek · BleepingComputer · The Hacker News
Commentary
This is a nasty one. The attack surface is enormous — HTTP/2 is the default on most modern web servers, and the exploit works against default configurations. That means the vast majority of sites haven’t proactively hardened against it. The fact that it was discovered by an AI coding tool adds an uncomfortable dimension: if Codex found it, adversarial actors with similar tools likely have too.
If you’re running anything web-facing, check your HTTP/2 configuration today. This isn’t a theoretical risk — proof-of-concept code is circulating, and widespread exploitation is only a matter of time.