Codex Reveals Critical HTTP/2 DoS Bomb Across Major Web Servers
OpenAI's Codex uncovered a remote denial‑of‑service exploit—HTTP/2 Bomb—that leverages HPACK compression and flow‑control stalls to drain memory on default configurations of nginx, Apache httpd, Microsoft IIS, Envoy, and Cloudflare Pingora. A single 100 Mbps host can incapacitate a vulnerable server within seconds, exposing a critical, unpatched web‑server weakness.