HTTP/2 to HTTP/1 downgrade request smuggling
Front ends that translate HTTP/2 to HTTP/1 can be desynced by smuggling a Content-Length or CRLF the rewriter trusts.
Tag: http2
Single-packet race conditions over HTTP/2
Send 20 to 30 requests in one TCP packet so they hit the same pre-commit window with near-zero jitter.