Go and enhance your calm: demolishing an HTTP/2 interop problem

According to Cloudflare, HTTP/2 can be powerful yet easy to misuse, with mitigations that close connections when abnormal client behaviour is detected and the ENHANCE_YOUR_CALM error is used. The post highlights a well‑known attack, CVE-2019-9512, aka PING flood, where incessant PING frames can force a peer to queue work and potentially exhaust resources.

It describes how, after introducing gRPC support in 2020, Cloudflare encountered interoperability issues with some clients that sent many PINGs, and notes a Rust Hyper feature called Adaptive Window that triggered a similar problem until a fix was made. In investigating a thread about which component sent the ENHANCE_YOUR_CALM code, the team confirmed a PING flood mitigation was active, tracing the root cause to a misbehaving Go HTTP/2 client that did not read the response body.

The solution involved reading the HTTP/2 body (even if empty) before closing the connection, implemented via io[.]Copy(io[.]Discard, resp[.]Body) before resp.Body[.]Close(), which eliminated the unnecessary RST_STREAM and PING frames and, in production, all ENHANCE_YOUR_CALM closures. 2 September 2025.