A flaw in the HTTP/2 implementation allows a remote attacker to trigger a denial of service by sending a specially crafted HPACK compression payload coupled with a zero‑byte flow‐control window. The small input data causes a large memory allocation on the server, which is then retained, exhausting resources and making the server unavailable to legitimate users. This defect is a classic denial‑of‑service weakness categorized as CWE‑409.

The vulnerability affects any web server that implements the HTTP/2 protocol. No specific vendor or product details are listed in the available information, but all HTTP/2‑supporting servers could be impacted.

The vulnerability has a CVSS score of 7.5, indicating high severity, and is not listed in the CISA KEV catalog, suggesting it is not widely known as a publicly exploited vulnerability yet. The attacker can initiate the exploit remotely over the network by exploiting the server’s HTTP/2 implementation; the likely attack vector is via an HTTP/2 connection from a public endpoint, requiring only internet reachability and no privileged access.