GHSA-vpp8-g58w-m8mp - Twisted: Unauthenticated Remote Denial of Service in the Twisted HTTP/2 Server via Rapid Stream Reset

## Summary An uncontrolled-resource-consumption vulnerability (CWE-400) in the Twisted HTTP/2 server lets any unauthenticated remote client exhaust server CPU over a single connection. A client that sends a request header block with `END_STREAM` and then immediately resets the stream makes the server route and render the request before it processes the reset. Reset streams are freed and never count against the concurrent-stream limit, and no reset-rate limiter exists, so the pattern can be repeated at line rate on one connection. This is the HTTP/2 Rapid Reset class, CVE-2023-44487. ## Details For one received segment the h2 events are processed in order in `H2Connection.dataReceived`. A `HEADERS(END_STREAM)` followed by `RST_STREAM` yields `RequestReceived`, `StreamEnded`, then `StreamReset`, so the request is dispatched and rendered on stream end before the reset is handled: ```python # src/twisted/web/_http2.py (H2Connection.dataReceived) for event in events: if isinstance(event, h2.events.RequestReceived): self._requestReceived(event) # allocate the request elif isinstance(event, h2.events.StreamEnded): self._requestEnded(event) # -> requestComplete -> render() synchronously elif isinstance(event, h2.events.StreamReset): self._requestAborted(event) # processed last, frees the stream ``` `_requestAborted` frees the reset stream, so it never occupies the 100-stream concurrency budget, and nothing in `_http2.py` counts or throttles opened-and-reset streams. The 2019 flood fix (GHSA-32gv) bounds outbound control-frame buffering only and does not apply to this path. Affected product: Twisted, `twisted.web` HTTP/2 server Affected versions: confirmed against 26.4.0 ## PoC On any Twisted HTTP/2 endpoint, open one connection and, in a tight loop, send a `HEADERS` frame with `END_STREAM` on a fresh stream identifier immediately followed by a `RST_STREAM` for that stream, at line rate. No credentials are required