BlueHat IL 2026 - Gal Bar Nahum - How HTTP/2 Lets Dead Streams Keep Servers Working

What happens when a widely used internet protocol is great on paper, but in practice isn't aligned with existing server architectures? That's fertile ground for a protocol-level vulnerability that affects almost everything... In this talk, we'll look at MadeYouReset, a design flaw vulnerability in HTTP/2 that affected many servers and implementations, including Apache Tomcat, H2O, Netty, swift-nio, F5, and more. We'll explore how the performance improvements of HTTP/2 introduced a gap that could be abused, allowing an attacker to make a server to consume resources far beyond what the protocol intends, resulting in severe denial-of-service conditions. We'll also see how revisiting a vulnerability from 2023 led to the discovery of MadeYouReset. Finally, we'll explain why this flaw appears in so many implementations, why fully fixing it is often infeasible, and what conditions make MadeYouReset especially harmful. After this talk, you'll understand why reviewing an RFC is not enough to find protocol vulnerabilities, and which implementation surfaces are worth investigating next.