Birthday attack
Collisions show up after the square root of the possibilities, not the possibilities — which is why a 256-bit hash is only worth 128.
The name comes from the birthday paradox: in a room of 23 people the odds are better than even that two share a birthday, despite the year having 365 days. The same arithmetic governs hash values. For an n-bit hash it takes only about 2^(n/2) attempts before two arbitrary inputs collide.
That is why collision resistance is always half the hash length: SHA-256 gives 128 bits of security against collisions, not 256. The distinction from finding a collision with a specific value matters — that still costs 2^n. The attack finished SHA-1 off for real in 2017, when Google and CWI produced two PDF files with identical hashes for roughly 2^63 operations.