Preliminary research

Codex Discovered a Hidden HTTP/2 Bomb

Calif · Calif · 2 June 2026

AI-collected research leads through 22 September 2026, including targeted additions between broader sweeps. Unranked, incomplete, not community-vetted, and subject to change.

HPACK lets a client seed the dynamic table once and then send thousands of one-byte indexed references; the per-entry bookkeeping a server allocates around a nearly empty header (about 70 bytes on nginx and IIS, 4,000 on Apache httpd and Envoy) never trips the decoded-size cap, and splitting Cookie into crumbs evades header-count caps. A zero flow-control window with 1-byte WINDOW_UPDATE drips pins it all, holding about 32GB in seconds from a single client.

Record

Researcher

Calif

Published by

Calif

Date

2 June 2026

Topic

HTTP

In the archive

• Collected in the 2026 preliminary research sweep

Related sources

• Per-server writeups, labs and PoCs — github.com
• patches Advisory

Tags

• dos
• http2
• algorithmic-complexity
• cookie
• cve
• llm
• ai-agent
• prior-art-extension
• owasp-a04-2021
• owasp-a07-2021

This page is the archive's own catalogue record. The research is the work of Calif, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 10 August 2026.