The Stream Is Dead, Long Live the Stream - How HTTP 2 Lets Dead Streams Keep Servers Working

The talk treats HTTP/2 weaknesses as failures of request lifetime rather than bugs in one codebase. It begins with the 2023 Rapid Reset disclosure, which is usually explained as a flood of cancelled requests. The speaker argues the real issue is that a stream can be closed at the protocol level while the back end is still computing a response for it. Those closed-but-active requests are called phantom streams.

Tracing how a server's HTTP/2 module hands off to its back end showed that the reset event is generally discarded by the rest of the server, so work continues and the finished response is thrown away. Cancellation was tested on Rust's Hyper and related frameworks, and it failed in some paths even where it appeared to work. The MadeYouReset variant forces the server to send the reset itself, for example through a zero-increment window update, which avoids the client-side reset limits added after Rapid Reset. Demonstrations on Pingora and Actix Web showed CPU and memory climbing until the servers crashed.

The root cause, according to the speaker, is architectural: HTTP/2 was added to servers built around an HTTP/1.1 interface that had no cancellation, and full cancellation across legacy code and external services is impractical. Because phantom streams cannot be eliminated, the proposed mitigation is to limit resets sent by the server as well as by the client. The takeaway for practitioners is to check how protocol features actually integrate with the software beneath them.