Sometimes a website starts behaving as if it is under a heavy DDoS attack: pages open slowly, the API responds with delays, 502 or 503 errors appear in the logs, and web server processes suddenly start consuming much more memory. But at the same time, there is no huge stream of requests, the channel is not saturated, and the load may come from a small number of connections. This is how HTTP/2 Bomb works. It is a DoS attack on HTTP/2 – the protocol through which a website or application exchanges data with the server. The attacker sends a relatively small amount of data but forces the server to spend much more memory processing it. As a result, the web server or proxy may freeze, start using disk instead of RAM, restart processes, or stop serving regular users properly.
