An unauthenticated remote denial of service vulnerability exists in the Twisted HTTP/2 server (CVE-2023-44487). A remote client can rapidly send a request header with END_STREAM followed immediately by a stream reset, causing the server to render the request before processing the reset. Because reset streams are freed and do not count against the concurrent-stream limit, this can be repeated at line rate on a single connection, exhausting CPU resources. This vulnerability affects Twisted version 26.4.0 and is classified as high severity with no confidentiality or integrity impact.