The HTTP/2 Bomb vulnerability targets HPACK (HTTP/2's header compression scheme) by combining a compression bomb technique with a Slowloris-style hold. The attack exploits the per-entry bookkeeping that servers allocate around nearly empty headers, where one byte on the wire becomes one full header allocation on the server, repeated thousands of times per request. The attack uses a zero-byte flow-control window that prevents the server from freeing any allocated memory. Unlike classic HPACK bombs that stuff large values into tables, this variant creates amplification through nearly empty headers that bypass decoded-size limits because there's almost nothing to decode.