> To mitigate against the non-cancelling variant of this attack, we recommend that HTTP/2 servers should close connections that exceed the concurrent stream limit. This can be either immediately or after some small number of repeat offenses.

https://cloud.google.com/blog/products/identity-security/how...

Mitigations are just that, mitigations. They are as effective as buying a better door lock to protect your apartment from a nuke.

Most web services don't need clever protocol attacks to be downed by 20k machines.