Multiple denial-of-service vulnerabilities exist in HTTP/2 server implementations targeting HPACK, the HTTP/2 header compression scheme. Praxis proxy, which uses a fork of the pingora HTTP/2 server, is affected because its fork (v0.8.2) lacks a critical upstream patch that sets default HTTP/2 options to limit resource usage. Exploitation involves sending small HTTP/2 requests that cause large memory allocations, resulting in memory exhaustion. The issue was fixed upstream in pingora v0.8.1, and Praxis proxy patched this by setting max_header_list_size and max_concurrent_streams options in HTTP/2 server configuration. Proof-of-concept demonstrates memory usage spiking from ~6MB to ~700MB, which is mitigated after applying the patch.

Successful exploitation leads to denial-of-service by exhausting server memory through crafted HTTP/2 requests. This can degrade or disrupt service availability without impacting confidentiality or integrity. The CVSS score is 7.5 (high) reflecting the network attack vector, low complexity, no privileges required, no user interaction, and impact limited to availability.

A patch is available and should be applied. The fix involves setting HTTP/2 server options to limit header list size and concurrent streams, preventing excessive memory allocation. Users should upgrade Praxis proxy to version 0.5.2 or later where this patch is included. No additional mitigation is required beyond applying the official fix.