The remote DoS exploit affects Nginx, Apache, and Cloudflare.
Introducing HTTP/2 Bomb: a remote DoS in nginx, Apache httpd, Microsoft IIS, Envoy, and Cloudflare Pingora. A single client pins 32GB of server memory in 10s. Found by Codex.
Blog post: https://blog.calif.io/p/codex-discovered-a-hidden-http2-bomb
PoCs: https://github.com/califio/publications/tree/main/MADBugs/http2-bomb
The remote DoS exploit affects Nginx, Apache, and Cloudflare.
Introducing HTTP/2 Bomb: a remote DoS in nginx, Apache httpd, Microsoft IIS, Envoy, and Cloudflare Pingora. A single client pins 32GB of server memory in 10s. Found by Codex.
Blog post: https://blog.calif.io/p/codex-discovered-a-hidden-http2-bomb
PoCs: https://github.com/califio/publications/tree/main/MADBugs/http2-bomb
Many users expressed alarm over the HTTP/2 Bomb vulnerability's ability to remotely exhaust RAM on servers like Nginx Apache and IIS while others reacted positively to the OpenAI Codex discovery with relief thanks and server updates.
