Preliminary research

Codex Discovered a Hidden HTTP/2 Bomb

Calif · Calif · 2 June 2026

AI-collected research leads through 6 October 2026, including bounded month-by-month reviews of selected social and community sources from January through September. Unranked, incomplete, not community-vetted, and subject to change.

HPACK lets a client seed the dynamic table once and then send thousands of one-byte indexed references; the per-entry bookkeeping a server allocates around a nearly empty header (about 70 bytes on nginx and IIS, 4,000 on Apache httpd and Envoy) never trips the decoded-size cap, and splitting Cookie into crumbs evades header-count caps. A zero flow-control window with 1-byte WINDOW_UPDATE drips pins it all, holding about 32GB in seconds from a single client.

Record

Researcher

Calif

Published by

Calif

Date

2 June 2026

In the archive

• Collected in the 2026 preliminary research sweep

Related sources

• Per-server writeups, labs and PoCs
• Envoy advisory and mitigation

Tags

• dos
• http2
• algorithmic-complexity
• cookie
• cve
• llm
• ai-agent
• prior-art-extension
• owasp-a04-2021
• owasp-a07-2021

This page is the archive's own catalogue record. The research is the work of Calif, first published at the original source. Preserved copies are kept so the citation survives its host.