Posts tagged memory amp.

Walrus storage-node's HTTP/2 server ships with `http2_max_pending_accept_reset_streams = u32::MAX`, disabling the post-CVE-2023-44487 accounting limit. An unauthenticated attacker forces rapid stream resets, accumulating unbounded pending-accept-reset state → memory pin → OOM with no GOAWAY to shed load.