The HTTP/2 Bomb exploits the 'CONTINUATION' frame logic. In HTTP/2, headers that don't fit into a single HEADERS frame are sent in subsequent CONTINUATION frames. The vulnerability occurs when a server fails to limit the total number or cumulative size of these frames for a single request. An attacker can send an endless stream of CONTINUATION frames without the 'END_HEADERS' flag, forcing the server to keep the stream open and continue allocating memory to reassemble the 'infinite' header. This leads to rapid heap exhaustion and CPU spikes as the server attempts to manage the growing data structure.
while(true) {
  send_frame(STREAM_ID, TYPE_CONTINUATION, FLAGS_NONE, DATA_CHUNK);
  // Omit END_HEADERS flag to keep the server in a 'waiting' state
  // Server continues to allocate memory for the 'infinite' header block
}
Mitigation involves implementing a strict 'Max Header List Size' and a 'Max Continuation Frame Count' per stream. By enforcing these limits, the server can identify and terminate a 'Bomb' attack before it consumes critical resources. Additionally, servers should implement a timeout for header completion to prevent 'Slowloris' style resource pinning.