Envoy, and subsequently Istio are vulnerable to a series of trivial HTTP/2-based DoS attacks:</p><ul><li>HTTP/2 flood using PING frames and queuing of response PING ACK frames that results in unbounded memory growth (which can lead to out of memory conditions).</li><li>HTTP/2 flood using PRIORITY frames that results in excessive CPU usage and starvation of other clients.</li><li>HTTP/2 flood using HEADERS frames with invalid HTTP headers and queuing of response <code>RST_STREAM</code> frames that results in