A mismatch between HTTP/2 specifications and the internal architectures of some implementations leads to incorrect stream accounting. By opening streams and rapidly triggering the server to reset them using malformed frames or flow control errors, a remote attacker can cause excessive server resource consumption. This occurs because streams reset by the server are considered closed at the protocol level, while backend processing continues, allowing a client to force the server to handle an unbounded number of concurrent streams on a single connection. This issue, dubbed MadeYouReset, can be used to launch massive denial-of-service (DoS) attacks and bypasses existing Rapid Reset mitigations by tricking the server into resetting its own stream counters. The attack traffic often blends with legitimate traffic, making detection difficult.