A denial-of-service vulnerability affects HTTP/2 servers that mishandle resource consumption during stalled flow-control. Remote, unauthenticated attackers can exploit this by using flow-control parameters to prevent data transmission. This causes servers to buffer response data excessively, leading to memory exhaustion. HTTP/2 uses flow control to prevent senders from overwhelming receivers via window sizes. Clients can stall this flow by not sending WINDOW_UPDATE frames or setting an initial window size of zero. Some server implementations continue generating response bodies even without being able to send them. This buffered data occupies server memory, with each stalled stream consuming resources until the connection ends. Attackers can open many streams, request large resources, and cause significant memory accumulation. This can lead to system instability, crashes, or reduced service availability. Vendors have released updates to address this vulnerability, and implementing resource limits and connection termination helps mitigate risk.