HTTP/2 Bomb: Default Configs in NGINX, Apache, IIS, Envoy and Pingora Open Door to Remote DoS
A chained protocol abuse discovered by OpenAI Codex and disclosed by Calif knocks over five of the most widely deployed web servers in their out-of-the-box state.
A newly disclosed denial-of-service technique against HTTP/2 implementations affects nearly every major web server in production today: NGINX, Apache HTTPD, Microsoft IIS, Envoy, and Cloudflare's Pingora.
The attack has been dubbed HTTP/2 Bomb by Calif, the firm publishing the disclosure. Per the advisory, the bug class "exists in each server's default HTTP/2 configuration" — meaning operators running stock builds are exposed without having opted into anything exotic.
The more interesting wrinkle: Calif credits the discovery to OpenAI Codex, which it says found the issue by chaining known HTTP/2 frame-handling behaviors into a single amplification primitive. (If accurate, that makes HTTP/2 Bomb one of the first widely impactful protocol bugs attributed primarily to an LLM-driven fuzzing pipeline rather than a human researcher.)
What we know
Details released so far are deliberately thin. Calif has not published full proof-of-concept code, and individual CVE assignments per affected server have not yet surfaced in public trackers. CVSS scoring is pending. What the advisory does state:
- The trigger lives in default HTTP/2 handling, not in optional modules or experimental features.
- The result is remote denial of service — resource exhaustion against the server process, not RCE or data disclosure.
- All five named stacks reproduce the condition.
That list covers the overwhelming majority of public-facing HTTP/2 termination on the internet. Pingora alone fronts a large slice of Cloudflare's edge. NGINX and Envoy together dominate Kubernetes ingress and service-mesh deployments.
Context: HTTP/2 keeps breaking
This is not the first time HTTP/2's stream and frame model has bitten implementers. The Rapid Reset attack (CVE-2023-44487) hammered the same vendors in late 2023 by abusing stream cancellation to drive record-setting DDoS volumes. MadeYouReset (CVE-2025-8671) followed earlier this year with a related reset-abuse variant. HTTP/2 Bomb appears to sit in the same family of state-machine abuse, though Calif has not yet confirmed whether reset frames are the specific vector.
No patches are linked in the initial disclosure. Defenders should expect a coordinated round of vendor advisories from F5/NGINX, the Apache Software Foundation, Microsoft, the Envoy maintainers, and Cloudflare in the coming days.
What to do now
Until per-vendor fixes land, the practical mitigation is the one operators already know from Rapid Reset: cap concurrent streams per connection, rate-limit new connections aggressively at the edge, and monitor for abnormal stream open/close ratios. If you front your HTTP/2 with a WAF or a CDN that has already shipped Rapid Reset mitigations, you are probably better positioned than a bare origin.
Watch vendor security pages directly. Treat any third-party PoC that surfaces this week as untrusted until the upstream advisories confirm the exact frame sequence involved.
