OpenAI Codex chains old DoS techniques into HTTP/2 Bomb that crashes servers in seconds

OpenAI Codex Discovers Critical HTTP/2 Bomb Vulnerability

Security researchers at Calif have disclosed a new denial-of-service exploit that marks a significant shift in how vulnerabilities are discovered. OpenAI Codex, an AI agent, identified the HTTP/2 Bomb by autonomously combining two known attack techniques that have existed for over a decade but were never chained together by human researchers 1

1

. The DoS attack can crash web servers in seconds, requiring only a single machine with a 100Mbps connection to render vulnerable web servers completely inaccessible 2

2

.

Researcher Quang Luong, who worked with the AI agent to validate the findings, plans to present full technical details at the Real World AI Security conference later this month. What makes this discovery particularly notable is that both attack components—HPACK compression bomb (CVE-2016-6581) and Slowloris-style hold (CVE-2016-8740 and CVE-2016-1546)—have been publicly documented for years, yet no human had recognized how they could be combined into a far more potent threat.

How Chained Decade-Old DoS Attacks Create Devastating Impact

The HTTP/2 Bomb exploits default HTTP/2 configurations on major web servers including nginx, Apache HTTP Server, Microsoft IIS, Envoy, and Cloudflare Pingora 1

1

. The attack works by first leveraging HTTP/2 compression amplification through the HPACK compression bomb technique, which sends thousands of tiny messages that force servers to rapidly allocate memory. The Slowloris-style hold component then maintains legitimate connections open indefinitely through flow-control stalling, preventing the server from releasing allocated resources 2

2

.

The combined effect is devastating. Against Apache httpd and Envoy, a single client can consume and hold 32GB of server memory in roughly 20 seconds 1

1

. Current defenses prove ineffective because the attack uses miniscule header values that bypass existing limits on total decoder header size. Upwards of 880,000 websites supporting HTTP/2 and running one of the affected web servers may be at risk.

Vendor Response and Patching Status for Vulnerable Web Servers

The disclosure timeline reveals varying response speeds across vendors. Calif disclosed the issue to nginx in April, and maintainers fixed it within 24 hours in version 1.29.8 by importing the max_headers directive from freenginx 1

1

. Apache issued a fix the same day Calif submitted its report, releasing mod_http2 v2.0.41 and assigning it CVE-2026-49975. Envoy has released patches that appear to mitigate the attack, though researchers continue validation efforts.

As of Thursday, Microsoft IIS and Cloudflare Pingora remained without patches, according to the researchers. However, Cloudflare disputes this characterization, stating that their existing architecture and DDoS mitigations automatically detect and protect against this attack, making no patch necessary 1

1

. Microsoft has not responded to inquiries. For unpatched systems, Calif recommends disabling HTTP/2 if possible or enforcing caps on the number of HTTP headers clients can send in a single request.

AI Agent Capabilities Signal New Era in Vulnerability Discovery

The fact that an AI agent, rather than human security researchers, identified complex vulnerabilities by reading codebases and recognizing how separate techniques could compose into a novel attack raises important questions about the future of cybersecurity. "What Codex did was read the codebases, recognize that the two compose, and build the combined attack," Luong explained, noting that the combination seems obvious in hindsight yet eluded human researchers for years 1

1

.

The research team notes that capable AI models can now turn public fix commits into working exploits by analyzing code diffs—precisely how they identified that Microsoft IIS, Envoy, and Pingora were also vulnerable after initial patches were published. Calif has released proof-of-concept exploit scripts on GitHub with warnings not to target infrastructure users don't own. Organizations should monitor their HTTP/2 configurations closely and apply patches as they become available, while watching for similar AI-discovered attack chains that may emerge as these capabilities become more widespread.