HPACK Compression Bomb

Expanded Definition

An HPACK compression bomb is a denial-of-service pattern in HTTP/2 where an attacker sends header blocks that are inexpensive to transmit but expensive to decompress, normalize, and store in memory. HPACK is the header compression mechanism defined for HTTP/2, and the protocol itself allows compact wire representation that can expand into far larger server-side structures during decoding. The risk is not the compression format alone, but the ratio between input size, decompression work, and the server’s header-processing limits.

Definitions vary across vendors on whether a true “bomb” requires deliberately malformed headers or whether any compression-induced resource exhaustion qualifies. In practice, security teams should treat the term as a class of resource amplification attacks against HTTP/2 header handling, not as a single exploit signature. The most common misapplication is calling every large-header failure an HPACK compression bomb, which occurs when oversized legitimate headers trigger limits without adversarial compression behavior.

For protocol context, see RFC 7541, HPACK: Header Compression for HTTP/2.

Examples and Use Cases

Implementing protections against HPACK compression bombs often introduces stricter header limits and decoding overhead, requiring organisations to weigh availability hardening against compatibility with legitimate high-header workloads.

• Abuse of repeated header patterns that compress efficiently on the wire but expand into large decoded header tables during processing.
• Requests crafted to consume CPU and memory in reverse proxies, API gateways, or origin servers before application logic can reject them.
• Load testing that reveals whether HTTP/2 stacks enforce sane limits on header size, header count, and dynamic table growth.
• Defensive tuning informed by Ultimate Guide to NHIs, where HTTP/2-based service traffic may be part of machine-to-machine trust chains.
• Reviewing transport-layer controls alongside NIST SP 800-53 Rev 5 Security and Privacy Controls to ensure boundary devices enforce resource controls consistently.

Security engineering teams also use the term when evaluating service meshes, ingress controllers, and CDNs that normalize HTTP/2 traffic before it reaches internal APIs. In those environments, header decompression may be distributed across multiple layers, so a seemingly small request can still amplify into a meaningful operational burden.

Why It Matters in NHI Security

HPACK compression bombs matter in NHI security because many non-human workloads depend on HTTP/2 for API calls, token exchange, and service-to-service communication. If an attacker can exhaust memory or CPU at the edge, the failure can interrupt authentication paths, secret retrieval, and control-plane functions that support service accounts and agentic systems. That makes the issue more than a network nuisance; it becomes an identity availability problem.

NHI Management Group notes that Ultimate Guide to NHIs reports that 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, which is why transport-layer attacks that disrupt those identities deserve governance attention. The right response is to pair protocol limits with monitoring, rate controls, and explicit denial thresholds for header decoding. The most common failure mode is assuming application-layer authentication will absorb the impact, which occurs when edge services are left to decode attacker-controlled headers without hard bounds.

Organisations typically encounter the operational impact only after API timeouts, proxy crashes, or failed service authentication have already started, at which point HPACK compression bomb handling becomes operationally unavoidable to address.

Related resources from NHI Mgmt Group

• Why does AI-driven compression create identity governance risk?
• Should teams use AI compression differently for humans, NHIs, and autonomous systems?
• How do security teams know whether compression-related exposure is actually under control?
• Identity Narrative Compression