OpenAI Codex helps discover HTTP/2 Bomb DoS attack
OpenAI's Codex code generation model reportedly discovered an HTTP/2 Bomb denial-of-service attack that exploits compression mechanisms to crash web servers in seconds with minimal bandwidth. The technique targets known vulnerabilities in HTTP/2 implementations that have existed for decades, potentially affecting many web servers.
What happened
OpenAI's Codex discovered a denial-of-service technique called HTTP/2 Bomb that exploits compression and flow-control stalling to knock web servers offline in seconds.
The attack can consume over 30GB of RAM within seconds using a single computer with a 100 Mbps connection, and researchers noted it targets decades-old vulnerabilities in HTTP/2 server implementations.
Reported impact
Major web servers were confirmed vulnerable to the HTTP/2 Bomb attack, which can render them offline before they can react.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.