An unauthenticated remote denial of service vulnerability exists in the Twisted HTTP/2 server due to improper handling of rapid stream resets. A remote client can send a request with END_STREAM followed immediately by a stream reset, causing the server to render the request fully before processing the reset. This allows repeated rapid resets on a single connection to exhaust CPU resources, bypassing the concurrent-stream limit. The issue affects Twisted versions prior to 26.10.0rc1 and has no impact on confidentiality or integrity.