An unauthenticated remote denial of service vulnerability exists in the Twisted HTTP/2 server (CVE-2023-44487). A remote client can send a sequence of HTTP/2 frames that cause the server to render requests fully before processing stream resets, allowing CPU exhaustion via rapid stream resets on a single connection. This bypasses the concurrent-stream limit and leads to unbounded request processing. The vulnerability affects Twisted web HTTP/2 server version 26.4.0 and later. There is no impact on confidentiality or integrity, and no code execution is possible.