> The best way to exploit an HTTP/2 server is to exploit the HTTP/1.1 server behind it [1]. The exploit mentioned is the http/2 front end getting confused by t

> The best way to exploit an HTTP/2 server is to exploit the HTTP/1.1 server behind it [1]. The exploit mentioned is the http/2 front end getting confused by the amount of responses it gets because it never checked how many http/1.1 messages it was forwarding, it just assumed that the http/1.1 headers where matching the http/2 headers. Now in defense of http/2 this was completely expected, called out in the spec. as requiring validation in case of tunneling and ignored by every implementation.