HTTP/2 Bomb: OpenAI's Codex uncovers critical DoS risk for streaming infrastructure

This HTTP/2 vulnerability presents an immediate operational risk for streaming services, as unpatched servers are susceptible to rapid shutdown. Given the widespread use of HTTP/2 for content delivery, the incident underscores the need for continuous vigilance in protocol-level security and prompt patching cycles across the media supply chain. Monitoring the speed and completeness of patch deployments across the vendor ecosystem will indicate overall industry resilience.

The newly disclosed 'HTTP/2 Bomb' exploit, also tracked as CVE-2026-49975, affects major web servers including nginx, Apache httpd, Microsoft IIS, Envoy, and Cloudflare Pingora, leveraging their default HTTP/2 configurations (SecurityWeek, June 2026). Calif security researchers, who discovered the vulnerability using OpenAI’s Codex, noted that the attack can be launched from a home computer with a 100 Mbps connection and can render targeted servers unavailable within seconds (SecurityWeek, June 2026). The exploit combines a compression bomb, targeting HTTP/2’s HPACK header compression, with a Slowloris-style hold that prevents the server from freeing memory (CSO Online, June 2026). While some components of this attack have been known for a decade, Codex's ability to compose them into a functional exploit highlights AI's evolving role in security research—both for defense and offense (SecurityWeek, June 2026). Nginx released a fix in April (v1.29.8+), and Apache followed in late May (mod_http2 v2.0.41), while Microsoft IIS, Envoy, and Cloudflare Pingora had yet to release patches at the time of publication (CSO Online, June 2026). For unpatched systems, disabling HTTP/2 or fronting servers with solutions that cap header counts are recommended temporary mitigations (Cyber Security News, June 2026).