OpenAI’s Codex helps discover HTTP/2 Bomb DoS attack that can nuke over 30GB of RAM within seconds, knocking web…
- New DoS technique dubbed HTTP/2 Bomb
- Exploits compression and flow‑control stalling
- Major web servers confirmed vulnerable
We can thank AI for a new denial-of-service (DoS) technique that can knock a server offline in mere seconds, using nothing but a single computer with a 100 Mbps connection.
Earlier this week, cybersecurity researchers Calif disclosed discovering a new DoS technique called HTTP/2 Bomb. They used OpenAI’s Codex software agent to discover it, saying it combines two previously known HTTP/2 DoS methods: the HPACK compression amplification, and Slowloris-style resource retention via HTTP/2 flow-control stalling.
Simply put, the attack tricks a web server into reserving large amounts of memory while sending very little data. The attacker exploits a feature in HTTP/2 that allows small requests to expand into much larger amounts of data inside the server, forcing it to allocate memory.
Proof of Concept released
Normally, that memory would be released after processing the...
Copyright of this story solely belongs to techradar.com. To see the full text click HERE
