http2

HTTPX2 is a next-generation HTTP client library for Python, continuing HTTPX's legacy with added features like HTTP/2 support and async APIs, now maintained by Pydantic.

Researchers used OpenAI's Codex agent to chain two decade-old DoS techniques into an HTTP/2 Bomb that can crash vulnerable web servers in seconds, affecting major servers like nginx, Apache, IIS, Envoy, and Pingora.

Codex discovered a remote denial-of-service exploit dubbed 'HTTP/2 Bomb' that targets HPACK compression in major web servers (nginx, Apache, IIS, Envoy, Pingora), chaining a compression bomb with flow-control hold to exhaust server memory quickly.

Go 1.24 introduces native support for HTTP/2 cleartext (h2c) in the net/http package, eliminating the previous need for external wrapper packages. This post explains how to configure a Go HTTP server for h2c to work with services like Google Cloud Run.