VU#885548: Denial-of-service vulnerability in HTTP/2 servers via stalled flow-control conditions

Multiple HTTP/2 server implementations fail to limit resource consumption when clients stall outbound flow control (e.g., by withholding WINDOW_UPDATE or advertising SETTINGS_INITIAL_WINDOW_SIZE = 0). An unauthenticated remote attacker can open many concurrent streams requesting large responses; the server may continue to generate and buffer response bodies, leading to excessive memory/swap use, worker/connection exhaustion, degraded availability, and potentially crashes. The issue is a network-reachable denial-of-service via stalled flow-control conditions.