The discussion in this podcast provides an extensive analysis of the HTTP/2 protocol, detailing its architectural shift from the text-based HTTP/1.1 to a more efficient binary and stateful framework using features like multiplexing and HPACK header compression. It thoroughly explains how these performance-enhancing changes, which solve application-layer Head-of-Line (HOL) blocking, simultaneously introduce new security vulnerabilities centred on computational amplification and resource exhaustion. It examines several critical denial-of-service (DoS) vectors, including the Rapid Reset attack (CVE-2023-44487) and the HPACK Decompression Bomb, noting that these attacks exploit the protocol's state management complexities. Finally, the analysis discusses necessary layered mitigation strategies—stressing the need for edge protection via CDNs and WAFs—while concluding that HTTP/2's reliance on TCP's HOL blocking limitation necessitates the adoption of the successor protocol, HTTP/3 (QUIC).

Episode ID: 1000731483319

GUID: 393018b5-1beb-40bd-8af8-2084a5ec4149

Release Date: 12/10/2025, 20:00:00