HTTP/2
The second major version of the HTTP protocol, standardized in 2015. It introduces multiplexing, binary framing, header compression (HPACK), and server push, and serves as the underlying transport protocol for gRPC.
Core Facts
Compared to WebSocket, SSE is lighter to implement, natively supports automatic reconnection, and is the superior engineering choice for unidirectional scenarios where only server-side push is needed.
HTTP/2 uses multiplexing technology to allow concurrent transmission of multiple requests over a single TCP connection, while HTTP/3 switches the transport layer from TCP to the QUIC protocol.
Timeline (last 90 days)
Since 2023, variant attacks exploiting protocol vulnerabilities such as HTTP/2 have increased significantly.
HTTP2Shell chains together HTTP/2 frame handling and Brotli decompression, amplifying the impact of a single-point defect.
http2shell refers to a class of remote code execution (RCE) risks triggered through the HTTP/2 protocol, with impact scope covering mainstream runtimes such as Node.js and Python.
Compared with HTTP/1.1, HTTP/2 introduces binary framing, header compression and multiplexing.
HTTP/2's binary framing layer splits communication into frame types such as HEADERS, DATA, SETTINGS and RST_STREAM, and each stream has its own ID and state machine (idle, open, half-closed, etc.).
HTTP/2 multiplexing allows multiple streams to be interleaved over the same connection, and mechanisms such as stream priority and window updates may become entry points for resource exhaustion.
Intercepting and rate-limiting anomalous HTTP/2 frames and oversized headers at the edge layer can reduce the risk of http2shell-type attacks.
QPACK is the algorithm used for header compression in HTTP/3, similar to HPACK in HTTP/2.
Claude once objected to implementing HTTP/2 for jpm, but the author insisted; measurements showed HTTP/2 was about 17% faster on home connections, but flat or worse on GitHub runners, with cold-start nuxt installs up to 2 times slower, 8% to 15% more CPU consumed on large tarballs, and a 60KB increase in binary size, so the 3671 lines of HTTP/2 code were ultimately deleted.
SSE runs on top of standard HTTP/1.1 chunked transfer encoding or HTTP/2 and HTTP/3 multiplexed streams.
3 more timeline events
All Facts (17)
Compared to WebSocket, SSE is lighter to implement, natively supports automatic reconnection, and is the superior engineering choice for unidirectional scenarios where only server-side push is needed.
75%VerifiedHTTP/2 uses multiplexing technology to allow concurrent transmission of multiple requests over a single TCP connection, while HTTP/3 switches the transport layer from TCP to the QUIC protocol.
75%UnverifiedCompared to HTTP/1.1, HTTP/2 supports multiplexing, header compression, and server push, resolving the head-of-line blocking problem of HTTP/1.1.
65%UnverifiedHTTP/2 is the HTTP protocol (RFC 7540) published by the IETF in 2015; its core innovations are binary framing and multiplexing, which resolve the head-of-line blocking problem of HTTP/1.1.
60%UnverifiedSince 2023, variant attacks exploiting protocol vulnerabilities such as HTTP/2 have increased significantly.
50%UnverifiedHTTP2Shell chains together HTTP/2 frame handling and Brotli decompression, amplifying the impact of a single-point defect.
50%UnverifiedIntercepting and rate-limiting anomalous HTTP/2 frames and oversized headers at the edge layer can reduce the risk of http2shell-type attacks.
50%Unverifiedhttp2shell refers to a class of remote code execution (RCE) risks triggered through the HTTP/2 protocol, with impact scope covering mainstream runtimes such as Node.js and Python.
50%UnverifiedCompared with HTTP/1.1, HTTP/2 introduces binary framing, header compression and multiplexing.
50%UnverifiedHTTP/2's binary framing layer splits communication into frame types such as HEADERS, DATA, SETTINGS and RST_STREAM, and each stream has its own ID and state machine (idle, open, half-closed, etc.).
50%UnverifiedHTTP/2 multiplexing allows multiple streams to be interleaved over the same connection, and mechanisms such as stream priority and window updates may become entry points for resource exhaustion.
50%UnverifiedQPACK is the algorithm used for header compression in HTTP/3, similar to HPACK in HTTP/2.
50%UnverifiedClaude once objected to implementing HTTP/2 for jpm, but the author insisted; measurements showed HTTP/2 was about 17% faster on home connections, but flat or worse on GitHub runners, with cold-start nuxt installs up to 2 times slower, 8% to 15% more CPU consumed on large tarballs, and a 60KB increase in binary size, so the 3671 lines of HTTP/2 code were ultimately deleted.
50%UnverifiedSSE runs on top of standard HTTP/1.1 chunked transfer encoding or HTTP/2 and HTTP/3 multiplexed streams.
50%UnverifiedCVE-2026-92392 is a use-after-free vulnerability originating from curl mishandling an HTTP/2 RST_STREAM sent by the server; when the reason is HTTP_1_1_REQUIRED or REFUSED_STREAM, it causes a use-after-free of struct Curl_easy.
50%UnverifiedHTTPX supports the HTTP/2 protocol, whereas requests only supports HTTP/1.1.
50%UnverifiedHTTP/2 头部压缩采用 HPACK 算法
50%