BEGIN:VCALENDAR
VERSION:2.0
PRODID:Data::ICal 0.24
BEGIN:VEVENT
DESCRIPTION:   'Title: The Stream Is Dead\, Long Live the Stream: How HTTP/
 2 Lets Dead\n   Streams Keep Servers Working\n   Tags: DEF CON Official Ta
 lk | Demo 💻 | Tool 🛠 | Exploit 🪲\n   When: Friday\, Aug 7\, 15:00
  - 15:59 PDT\n   Where: LVCCW Level 1 Hall 3 1006 (Main Track 1) and DCTV-
 1 - [1]Map\n\n   Description:\n\n   Modern protocol bugs rarely look like 
 flaws in the protocol itself.\n   They show up when a clean spec meets exi
 sting server architectures.\n   HTTP request smuggling showed this for req
 uest boundaries:\n   implementations disagreed about where one request end
 ed and the next\n   began. This talk asks a similar question about HTTP/2 
 request\n   lifetime: what happens when one layer thinks a request is over
 \, while\n   another is still working on it?\n\n   In 2023\, Rapid Reset s
 howed the world that HTTP/2 had a problem:\n   attackers could open and re
 set streams faster than servers could keep\n   up. The disclosure triggere
 d an industry-wide patching scramble\, but\n   patches addressed the sympt
 om\, not the root cause.\n\n   Two years later\, I disclosed MadeYouReset 
 through CERT/CC as\n   CVE-2025-8671\, exploiting the same root cause thro
 ugh a different door\n   and setting off a second round of patches across 
 the ecosystem\,\n   including Apache Tomcat\, H2O\, Netty\, and others.\n\
 n   In this talk\, I’ll show how research that started with Rapid Reset\
 n   led to MadeYouReset\, and how both create streams closed at the HTTP/2
 \n   layer while server-side request work continues. We’ll see why this\
 n   gap exists\, why fully fixing it is infeasible\, and what conditions\n
    make MadeYouReset especially harmful.\n\n   Finally\, we’ll answer th
 e question: is the next HTTP/2 abuse already\n   waiting around the corner
 ?\n\n   CERT/CC VU#767506: https://kb.cert.org/vuls/id/767506 NVD\n   CVE-
 2025-8671: https://nvd.nist.gov/vuln/detail/CVE-2025-8671\n   MadeYouReset
  blog posts: https://galbarnahum.com/made-you-reset\n\n   SpeakerBio:  Gal
  Bar Nahum\, Tenzai\n\n   Gal Bar Nahum is a security researcher at Tenzai
  with eight years of\n   experience in vulnerability research\, network pr
 otocol security\, red\n   teaming\, and AI research.\n\n   '\n\n   1. #LVC
 CW_Level1_Hall3\n\n\n
DTEND:20260807T225900Z
DTSTART:20260807T220000Z
LOCATION:DEF CON Talks - LVCCW Level 1 Hall 3 1006 (Main Track 1) and DCTV-
 1
SUMMARY:The Stream Is Dead\, Long Live the Stream: How HTTP/2 Lets Dead Str
 eams Keep Servers Working
END:VEVENT
END:VCALENDAR