diff --git a/src/http/v2/ngx_http_v2.c b/src/http/v2/ngx_http_v2.c

index 638ffaf..8b5975c 100644

--- a/src/http/v2/ngx_http_v2.c

+++ b/src/http/v2/ngx_http_v2.c

@@ -4065,6 +4065,8 @@ ngx_http_v2_close_stream(ngx_http_v2_stream_t *stream, ngx_int_t rc)

      */

     pool = stream->pool;

+    h2c->frames -= stream->frames;

+

     ngx_http_free_request(stream->request, rc);

     if (pool != h2c->state.pool) {

diff --git a/src/http/v2/ngx_http_v2.h b/src/http/v2/ngx_http_v2.h

index 6c42fee..282de8f 100644

--- a/src/http/v2/ngx_http_v2.h

+++ b/src/http/v2/ngx_http_v2.h

@@ -181,6 +181,8 @@ struct ngx_http_v2_stream_s {

     ngx_buf_t                       *preread;

+    ngx_uint_t                       frames;

+

     ngx_http_v2_out_frame_t         *free_frames;

     ngx_chain_t                     *free_frame_headers;

     ngx_chain_t                     *free_bufs;

diff --git a/src/http/v2/ngx_http_v2_filter_module.c b/src/http/v2/ngx_http_v2_filter_module.c

index dac5046..e1928d1 100644

--- a/src/http/v2/ngx_http_v2_filter_module.c

+++ b/src/http/v2/ngx_http_v2_filter_module.c

@@ -1017,22 +1017,34 @@ static ngx_http_v2_out_frame_t *

 ngx_http_v2_filter_get_data_frame(ngx_http_v2_stream_t *stream,

     size_t len, ngx_chain_t *first, ngx_chain_t *last)

 {

-    u_char                    flags;

-    ngx_buf_t                *buf;

-    ngx_chain_t              *cl;

-    ngx_http_v2_out_frame_t  *frame;

+    u_char                     flags;

+    ngx_buf_t                 *buf;

+    ngx_chain_t               *cl;

+    ngx_http_v2_out_frame_t   *frame;

+    ngx_http_v2_connection_t  *h2c;

     frame = stream->free_frames;

+    h2c = stream->connection;

     if (frame) {

         stream->free_frames = frame->next;

-    } else {

+    } else if (h2c->frames < 10000) {

         frame = ngx_palloc(stream->request->pool,

                            sizeof(ngx_http_v2_out_frame_t));

         if (frame == NULL) {

             return NULL;

         }

+

+        stream->frames++;

+        h2c->frames++;

+

+    } else {

+        ngx_log_error(NGX_LOG_INFO, h2c->connection->log, 0,

+                      "http2 flood detected");

+

+        h2c->connection->error = 1;

+        return NULL;

     }

     flags = last->buf->last_buf ? NGX_HTTP_V2_END_STREAM_FLAG : 0;