Collected research

Comparisons and attacks on HTTP2 (Comparaisons et attaques sur HTTP2)

Georges Bossert · SSTIC

Uses active automata learning with L* to compare HTTP/2 server state machines, then guides a fuzzer through valid states before mutating messages and transitions. Tests of Apache, Nginx, H2O and Tomcat expose divergent behavior and security bugs. The slides also propose state-machine fingerprints and discuss how inconsistent stream handling could complicate intrusion detection.

Record

Researcher

Georges Bossert

Published by

SSTIC

Format

Whitepaper

Topic

HTTP

In the archive

• Collected in the 2016–17 research round

Tags

• http2
• fuzzing
• formal-analysis
• parser-differential
• tooling
• detection
• owasp-a09-2021

This page is the archive's own catalogue record. The research is the work of Georges Bossert, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 10 September 2026.