Other nomination

MadeYouReset Technical Details - How (and Why) It Works?

Gal Bar Nahum

MadeYouReset makes an HTTP/2 server reset a stream itself, using primitives such as a zero-increment window update or a frame sent after the client closed the stream. The reset frees the concurrency slot at once while backend work continues, so an attacker beats the concurrent-stream limit and floods a server with unbounded in-flight requests.

Record

Researcher

Gal Bar Nahum

In the archive

• Nominated for the 2025 Top 10 Web Hacking Techniques

Tags

• dos
• http2
• proxy
• reverse-proxy
• http
• prior-art-extension
• mitigation

This page is the archive's own catalogue record. The research is the work of Gal Bar Nahum, first published at the original source. Preserved copies are kept so the citation survives its host.