HTTP/2 Bomb: HPACK Indexed-Reference Amplification Chain Attack

A high school student's independent technical deep-dive
June 2026

TL;DR

This repository contains my complete analysis of the HTTP/2 Bomb vulnerability (CVE-2026-49975 / CVE-2026-47774), which chains two decades-old HTTP/2 primitives:

• HPACK indexed-reference amplification – sending thousands of single-byte references to a nearly-empty dynamic table entry
• Flow-control window stall – zero initial window + periodic 1-byte WINDOW_UPDATE to pin memory forever

Result: A single 100 Mbps client can exhaust 32 GB of server memory in as few as 10 seconds.

🧠 How I Got Into This

It all started while I was doom‑scrolling Bilibili (China’s YouTube). A tech channel briefly mentioned “a new HTTP/2 attack that takes down major web servers.” No details, just the headline.

That caught my brain. I paused the video, opened the disclosure link, and fell into a rabbit hole. One paper led to five CVEs, led to RFCs, led to source code. I didn't stop until I understood exactly why a single byte on the wire could pin 59 bytes of memory – and why nobody had chained the two tricks together before.

So this repo is not just a summary. It’s my full, uncompromising deep‑dive, written from scratch in LaTeX. No teacher asked me to do it. I just couldn’t let go.

Impact

Affects default configurations of all five major web server implementations:

Contents

Chinese blog post (layman-friendly):
https://www.itedev.com/posts/2026/06/12/http2-bomb-blog-zh

Key Findings (Independent)

1. The amplification comes from per-entry bookkeeping overhead (pool blocks, structs), not decoded size – bypasses traditional HPACK bomb defenses.
2. Cookie crumb merging in Apache produces quadratic memory growth O(N²).
3. Envoy's cookie buffer bypasses max_request_headers_kb – up to 5,700× amplification.
4. RFC 7541 §7.3 spec defect: only models compression ratio, not per-entry allocator overhead + flow-control pinning.

Defensive Model

“Maximum decoded header size” and “maximum header count” are two different limits, and a server needs both.

Why This Matters

This vulnerability was discovered by AI (Codex) reading across five codebases simultaneously – a new class of cross-implementation protocol flaws that “nobody owns the seams.”

Based On

Coordinated disclosure by Quang Luong, Jun Rong, Duc Phan (Calif Security Research), June 2, 2026.
Original paper: blog.calif.io/p/codex-discovered-a-hidden-http2-bomb

Author

Zhicheng Wu
Xinhui No.1 Middle School, Class of 2028
Guangdong, China

License

This work is licensed under CC BY 4.0.
You are free to share and adapt, with attribution.

---

For academic and defensive purposes only.