Go and enhance your calm: demolishing an HTTP/2 interop problem

Cloudflare details how aggressive HTTP/2 client behavior—particularly Go clients that don’t fully read response bodies—can trigger ENHANCE_YOUR_CALM mitigations by causing repeated RST_STREAM+PING patterns resembling a PING-flood (e.g., CVE-2019-9512). The post explains the protocol mechanics, shows how to capture/debug the issue, and recommends always draining response bodies in Go to prevent unnecessary RST_STREAM and PING frames, thereby avoiding false positives from HTTP/2 DoS defenses.