A vulnerability in the Hysteria project allows an attacker to send excessively large HTTP headers without proper termination, causing the server to consume excessive memory and potentially crash. This occurs because the HTTP header sniffing implementation does not enforce an upper limit on header size, leading to denial of service (DoS) via resource exhaustion. The issue affects versions prior to 2.9.2.