AI Autopsy: A New DoS Bombshell Discovered by AI

Denial of service (DoS) attacks rarely seem to garner much CISO discussion these days. Yes, they can still cause financial and reputational damage. But most CISOs who can afford to, outsource mitigation to specialist firms and content delivery network (CDN) providers like Akamai and Cloudflare. A newly discovered vulnerability might change this calculation.

Immediate remediation of HTTP/2 Bomb may be fairly straightforward. But the way in which it was found and the possibility of more novel discoveries like it could have far-reaching implications for enterprise cybersecurity.

Dropping the bomb

HTTP/2 Bomb (CVE-2026-49975) was discovered by researchers at Calif. At a technical level, it features two components. The first is HPACK amplification. HPACK is a compression scheme used by HTTP/2 to reduce header transmission size. Attacks exploiting CVE-2026-49975 abuse this feature so that threat actors can send header blocks that are relatively small on the wire but then expand into much larger structures at the other end during decompression. This consumes large amounts of memory and CPU: what’s known as “compression amplification”.

The second technique abuses “flow control” in HTTP/2, which is a feature designed to help manage multiple simultaneous requests and responses over the same connection. Attackers create a large number of these streams and then manipulate flow-control mechanisms so the server consumes excessive CPU and memory trying to manage them all.

The impact of combining these two techniques is to enable an attacker with only minimal resources to overwhelm a targeted server. According to Calif, a home computer on a 100Mbps connection can render a vulnerable server inaccessible within seconds.

“The trick itself is brutally simple: one byte on the wire makes the server allocate a whole header’s worth of memory, thousands of times over, and then the attacker just refuses to let any of it go,” Secure.com head of engineering, Waseem Ahmed, tells Assured Intelligence. “A single laptop can pin 32GB and take a box down in about 20 seconds.”

Lowering the barriers to entry

Calif claims that CVE-2026-49975 works on virtually all of the most popular web servers, including nginx, Apache httpd, Microsoft IIS, Envoy, and Cloudflare Pingora. Proof-of-concept (PoC) code was published on the researchers’ GitHub repository and, at the time of writing, no patch was available for IIS, Envoy or Pingora. That puts users of these servers in the firing line. Experts Assured Intelligence spoke to claim the exploitation barrier to entry for potential threat actors is “essentially zero”.

“A single laptop can pin 32GB and take a box down in about 20 seconds.” Waseem Ahmed

Volumetric attacks are, to an extent, already commoditised through booter and stresser services that are freely available online. However, HTTP/2 Bomb enables threat actors to crash major web servers at “near-zero cost”, according to Chris Steffen, VP of research at analyst Enterprise Management Associates (EMA).

“What HTTP/2 Bomb changes is efficiency – no botnet, no bandwidth required. In this attack, a one-machine attack delivers the same impact that previously required significant infrastructure,” he tells Assured Intelligence. “This eliminates the cost barrier that mitigated some of these attacks. Worse, this technique – now that it is proven – will be used for other exploits in the future.”

There’s also a risk that HTTP/2 Bomb will “eventually” be packed into those off-the-shelf booter services that have democratised DoS for so many miscreants, says Akamai director of security technology strategy EMEA, Richard Meeus.

CISOs can’t assume that their CDN provider will be able to take care of HTTP/2 Bomb and attacks like it, argues Secure.com’s Ahmed.

“To say that ‘DoS is a solved, commoditised problem’ is half true, and the half it misses is the dangerous one,” he explains. “Commodity scrubbing is excellent at volumetric floods, because that’s what it was built for. It is not built for a handful of almost-legitimate requests doing their damage at the protocol layer, behind the CDN, at your origin, which is exactly what this is.”

Opening the AI flood gates

Although all the impacted web server vendors will eventually patch their wares, the more concerning implications of HTTP/2 Bomb relate to how it was discovered. Both the compression amplification and flow-control abuse techniques it documents have been known about for years. But it was ChatGPT’s Codex AI assistant that linked them together in this novel way, according to Calif.

“The priority is ensuring the right tools, processes and vendor support are already in place.” Richard Meeus

As AI gets more powerful, the concern is that it’s able to discover new vulnerabilities like this at speed, collapsing the exploitation window with potentially devastating effect. It’s a challenge that extends to all categories of vulnerabilities.

“When an AI can read a codebase and assemble known primitives into a novel attack, and then turn the eventual fix commit back into an exploit, your exposure window and your patch speed become your real DoS risk, not bandwidth,” says Ahmed.

A new focus on architectural resilience

The immediate response to HTTP/2 Bomb should be fairly straightforward for CISOs, he continues.

“The biggest lesson is that CISOs need to start thinking in terms of architectural resilience.” John Strand

“Tactically, the boring stuff still matters: move nginx to 1.29.8 or later, which caps header count; upgrade Apache mod_http2 to v2.0.41; and for IIS, Envoy or Pingora, where fixes are still landing, disable HTTP/2 or front the origin with something that hard-caps headers per request,” Ahmed recommends.

“Underneath that, enforce two separate limits – maximum decoded header size and maximum header count, cookie crumbs included – to bind how long a stalled stream can live. And cap per-worker memory so a bombed process gets killed and respawned rather than dragging the whole box into swap memory.”

Longer term, however, CISOs may need a strategic rethink to mitigate AI-powered vulnerability research and exploit development.

“AI may accelerate vulnerability discovery, so the priority is ensuring the right tools, processes and vendor support are already in place,” Akamai’s Meeus tells Assured Intelligence. “The key is applying them consistently and at speed. That means maintaining strong cyber hygiene, validating DDoS protections and working with vendors that can respond quickly as discovery and exploitation accelerate.”

EMA’s Steffen urges security teams to invest in AI-assisted analysis tools to run against their infrastructure, “before your adversaries do”. But plans must go beyond patch management to include “architecture, resilience, and staffing”, argues IANS faculty and SANS instructor, John Strand.

“The biggest lesson is that CISOs need to start thinking in terms of architectural resilience. Ask yourself a simple question: what happens if a critical vulnerability exists in every public-facing component of our infrastructure at the same time?” he tells Assured Intelligence. “If that thought experiment makes you uncomfortable, that’s probably where you should start.”

Strand, who is the founder of Black Hills Information Security, says lesson number two involves risk prioritisation. He suggests a practical exercise for CISOs.

“Look at the vulnerabilities you’ve postponed because you didn’t have time or resources to address them. Add one point to those scores and ask whether that changes your patching priorities,” he explains. “In a world where AI may accelerate vulnerability discovery, many organisations should be reevaluating how they think about risk.”

Ultimately, the new world of AI-powered vulnerability will ask searching new questions of CISOs. It doesn’t mean they need to become experts on every technical detail. But a keen eye on the evolving policies, processes and controls needed to operate in this new world will be key. Traditional controls still matter. They should be complemented by good change management and QA testing, strong network forensics, and visibility into outbound communications to identity new command and control (C2) channels, says Strand.

“This isn’t just about one HTTP/2 vulnerability,” he concludes. “It’s about preparing for a future where the volume and speed of vulnerability discovery increase dramatically.”