OpenAI's Codex chains decade-old DoS techniques into HTTP/2 Bomb

Jump to main content

Search

REG AD

Security

OpenAI's agent chained decade-old DoS attacks to crash web servers in seconds

Codex drops an HTTP/2 Bomb

Jessica Lyons

Jessica<br>Lyons

Published<br>thu 4 Jun 2026 // 20:08 UTC

The next threat your server faces may have been helped along by a bot. OpenAI's Codex agent helped uncover a remote denial-of-service (DoS) exploit that can be launched from a single machine to render vulnerable web servers inaccessible in seconds, according to Calif security researchers.<br>The attack works on default HTTP/2 configurations of major web servers including nginx, Apache HTTP Server, Microsoft IIS, Envoy, and Cloudflare Pingora. As of Thursday, Microsoft IIS and Cloudflare Pingora still don’t have a patch, according to the researchers, although Cloudflare disputes this finding.<br>“Cloudflare's existing architecture and DDoS mitigations automatically detect and protect against this attack, making customers resilient to this vulnerability,” a spokesperson told The Register. “No patch is needed.”

REG AD

REG AD

“We are aware and actively investigating appropriate mitigations to help keep customers protected," a Microsoft spokesperson told The Register.<br>Calif researcher Quang Luong discovered the exploit, named it HTTP/2 Bomb, and will present the full technical details of the attack at the Real World AI Security conference later this month. In the meantime, there are proof-of-concept exploit scripts on GitHub along with a warning from the AI red teaming security shop: “Please don't point these at infrastructure you don't own.”<br>In a Tuesday blog, Luong says Codex chained two existing DoS attack techniques that have been known for more than a decade - HPACK compression bomb and Slowloris-style hold - and warns that upwards of 880,000 websites supporting HTTP/2 and running one of the vulnerable web servers may be affected.<br>An HPACK bomb attack (also known as CVE-2016-6581) exploits the HTTP/2 header compression algorithm (HPACK) by sending thousands of tiny messages to the server, forcing it to rapidly allocate memory and ultimately crash.<br>Then the Slowloris DoS attack (CVE-2016-8740 and CVE-2016-1546) overwhelms the server by opening legitimate connections and maintaining them as long as possible.<br>Combining the two exhausts the server’s memory and forces it offline.<br>“A home computer on a 100Mbps connection can render a vulnerable server inaccessible within seconds,” Luong wrote. “Against Apache httpd and Envoy, a single client can consume and hold 32GB of server memory in roughly 20 seconds.”<br>The Calif research team disclosed the issue to nginx in April, and the web server’s maintainers fixed it the next day in version 1.29.8, which imports the max_headers directive from freenginx.

REG AD

Apache issued a fix (mod_http2 v2.0.41) the same day that Calif submitted its report, and assigned it CVE-2026-49975.<br>“The fix commits above are public and disclose the vectors directly; any capable AI model can turn those diffs into a working exploit, which is exactly how we found that Microsoft IIS, Envoy, and Pingora are also vulnerable,” the threat hunting team wrote, adding that all three have been notified.<br>In a Wednesday update, Calif pointed to Envoy patches “that appear to mitigate this attack,” and notes that its researchers are still validating the fix to ensure it works.

MORE CONTEXT

'Please do not vibe f--- up this software': Broken backups spark AI coding row in rsync project

AI agents show they can create exploits, not just find vulns

Agent harnesses, like OpenClaw, are changing how we build and run AI models

Nobody needs Mythos or 0-days to build a chaos-causing computer worm – free open source models work just fine

For Microsoft IIS and Cloudflare Pingora, the security sleuths recommend disabling HTTP/2 if possible, or enforcing a cap on the number of HTTP headers a client can send in a single request to the server.<br>The fact that a coding agent - not a human - discovered this attack is notable, according to Calif. “Both halves have been public for a decade,” Luong wrote. “What Codex did was read the codebases, recognize that the two compose, and build the combined attack. That combination is obvious once you see it, and yet as far as we can tell no human had put it together against these servers.” ®<br>Updated at 2023 with statement from Microsoft.

denial-of-service<br>codex<br>security<br>openai<br>http2

REG AD

SPONSORED LINKS<br>Building the New Trust Architecture for AI - Watch Now

AI AND ML

'It would be good for the world' to slow down AI sprints, Anthropic says

The plea for caution comes the same week it beat AI archrival OpenAI to filing for an IPO

CYBER-CRIME

Pink is the latest goon squad to use fake helpdesk calls to steal creds

A familiar tactic popularized by chaotic crime crew Lapsus$

ZTE and partners nurture global ICT talent through 2026 engineering capacity building program

Global ICT experts gather...