Until you run into a HTTP/2 to HTTP/1 tunneling setup where your HTTP/2 frontend thinks it forwarded one well defined and safe HTTP/1 message to your backend, b

Until you run into a HTTP/2 to HTTP/1 tunneling setup where your HTTP/2 frontend thinks it forwarded one well defined and safe HTTP/1 message to your backend, but the backend sees an additional malformed HTTP/1 header field that changes the message length and suddenly it sees a second malicious message. The result leaking thousands of user authentication tokens for some widely used web services. If necessary robustness should be part of the spec, not some wild and ill defined outgrowth of implementations that some intern hacked in at the eleventh hour to make things work just before release.