“HTTP/2 downgrading is when a front-end server speaks HTTP/2 with clients, but rewrites requests into HTTP/1.1 before forwarding them on to the back-end server.”
HTTP/2 was supposed to kill request smuggling with fixed-length binary frames. Then everyone put an HTTP/2 front end on an HTTP/1.1 back end. The translation layer brought the ambiguity right back. Amazon’s load balancer, WAFs and CDNs all fell for it. The upgrade was half done, and the attacker lives in the other half.