We’re publishing HTTP/2 Bomb, a remote denial-of-service exploit against most major ...

2026-06-02 23:18:29 UTC

https://blog.calif.io/p/codex-discovered-a-hidden-http2-bomb

We’re publishing HTTP/2 Bomb, a remote denial-of-service exploit against most major web servers, including:
nginx
Apache httpd
Microsoft IIS
Envoy
Cloudflare Pingora
The vulnerable behavior exists in each server's default HTTP/2 configuration.

A home computer on a 100Mbps connection can render a vulnerable server inaccessible within seconds.

#infoSec #cybersecurity #apache #nginx #http2

Thx npub1ttp0eazljtee4mnk7s0teuyv3ftc3ta5dg2j4sgm0rc7alk4cy6qyxqhsf (npub1ttp…qhsf) for pointing it out

Author Public Key

npub1jf0uy767huzc3ccqw77r7zwuxzzyx72w04wdzt7kwhjxp26l2usqt0v5m4

Seen on

wss://relay.momostr.pink

Show more details

Published at

2026-06-02 23:18:29 UTC

Kind type

1 Short Text Note

Event JSON

{ "id": "ed593d31a75cebd6a33b42f628ae5476579960df050fe077f0ee30f7221b27d9", "pubkey": "925fc27b5ebf0588e30077bc3f09dc308443794e7d5cd12fd675e460ab5f5720", "created_at": 1780442309, "kind": 1, "tags": [ [ "p", "5ac2fcf45f92f39aee76f41ebcf08c8a5788afb46a152ac11b78f1eefed5c134" ], [ "proxy", "https://milliways.social/@mcfly/116683067196459369", "web" ], [ "t", "infosec" ], [ "t", "cybersecurity" ], [ "t", "nginx" ], [ "t", "http2" ], [ "imeta", "url https://milliways.social/system/media_attachments/files/116/683/063/428/016/149/original/4c04ce34adb84472.png", "m image/png" ], [ "t", "apache" ], [ "proxy", "https://milliways.social/users/mcfly/statuses/116683067196459369", "activitypub" ], [ "L", "pink.momostr" ], [ "l", "pink.momostr.activitypub:https://milliways.social/users/mcfly/statuses/116683067196459369", "pink.momostr" ], [ "-" ] ], "content": "https://blog.calif.io/p/codex-discovered-a-hidden-http2-bomb\n \nWe’re publishing HTTP/2 Bomb, a remote denial-of-service exploit against most major web servers, including:\nnginx\nApache httpd\nMicrosoft IIS\nEnvoy\nCloudflare Pingora\nThe vulnerable behavior exists in each server's default HTTP/2 configuration.\n \nA home computer on a 100Mbps connection can render a vulnerable server inaccessible within seconds.\n\n#infoSec #cybersecurity #apache #nginx #http2 \n\nThx nostr:npub1ttp0eazljtee4mnk7s0teuyv3ftc3ta5dg2j4sgm0rc7alk4cy6qyxqhsf for pointing it out\nhttps://milliways.social/system/media_attachments/files/116/683/063/428/016/149/original/4c04ce34adb84472.png\n", "sig": "72372fb0e659723932feb91843e96dc07b3bb174aab2f0032187e6a58a177dbe353e690b2036f52a7cd20b270a1e23ad403539862488d7f406718a8d31877831" }

mc.fly on Nostr: We’re publishing HTTP/2 Bomb, a remote denial-of-service exploit against most major ...