BlueHat IL 2026 - Gal Bar Nahum - How HTTP/2 Lets Dead Streams Keep Servers Working

Protocol-Level Bugs

Gal Bar Nahum of Tenrai presents a new HTTP/2 denial-of-service class rooted in specification design—not implementation typos—affecting major web servers. He contrasts these with typical code bugs found by reading source.

HTTP/2 and Rapid Reset

Streams multiplex requests over one TCP connection with an active-stream counter capped near 100. The 2023 Rapid Reset attack sent requests then immediately reset streams, keeping the counter low while forcing costly cancel handling; Google’s explanation focused on cancel expense and unlimited rate.

The Missed Design Flaw

Nahum argues Rapid Reset exposed a deeper break: servers decrement active streams on RST_STREAM but often ignore reset events, continuing backend work on canceled requests. That disconnect between protocol state and application processing enables sustained load without hitting concurrency limits.

Research Path

Understanding server architecture—HTTP/2 module versus backend unaware of HTTP version—led to discovering follow-on attacks leveraging dead streams that still consume server resources, extending lessons from Rapid Reset into new exploit variants.