POC and self-contained lab that reproduces the HTTP/2 Bomb (hpack indexed-reference bomb + slowloris window stall) - View it on GitHub