Twisted: Unauthenticated Remote Denial of Service in the Twisted HTTP/2 Server via Rapid Stream Reset

Summary An uncontrolled-resource-consumption vulnerability CWE-400 in the Twisted HTTP/2 server lets any unauthenticated remote client exhaust server CPU over a single connection. A client that sends a request header block with ENDSTREAM and then immediately resets the stream makes the server rou...