Uncontrolled resource consumption allows an unauthenticated remote attacker to pin HTTP/2 stream processes indefinitely. By sending a trickle of small `WINDOW UPDATE` frames or empty `SETTINGS` frames, an attacker can reset the 15-second deadline for blocked stream processes. This occurs through two independent paths: one where `Bandit.HTTP2.Connection.finish data/5` re-queues partially advanced sends in `pending sends` with a fresh `expires at` timestamp, and another where `Bandit.HTTP2.Stream.send data/3` recurses on each stream `WINDOW UPDATE` and re-arms a fresh `read timeout`. This behavior keeps the blocked stream process, its Plug state, and associated resources alive, potentially exhausting server processes and memory.