Suricata

Could you test with the following patch ?

diff --git a/rust/src/http2/http2.rs b/rust/src/http2/http2.rs
index 9a0330103..8b4112ead 100644
--- a/rust/src/http2/http2.rs
+++ b/rust/src/http2/http2.rs
@@ -466,17 +466,19 @@ impl HTTP2State {
                     Ok((_, set)) => {
                         for i in 0..set.len() {
                             if set[i].id == parser::HTTP2SettingsId::SETTINGSHEADERTABLESIZE {
-                                //set for both endpoints ? to be tested
-                                self.dynamic_headers_tc.max_size = set[i].value as usize;
-                                self.dynamic_headers_ts.max_size = set[i].value as usize;
+                                //reverse order as this is what we accept from the other endpoint
+                                let dyn_headers = if dir == STREAM_TOCLIENT {
+                                    &mut self.dynamic_headers_ts
+                                } else {
+                                    &mut self.dynamic_headers_tc
+                                };
+                                dyn_headers.max_size = set[i].value as usize;
                                 if set[i].value > HTTP2_MAX_TABLESIZE {
                                     //mark potential overflow
-                                    self.dynamic_headers_tc.overflow = 1;
-                                    self.dynamic_headers_ts.overflow = 1;
+                                    dyn_headers.overflow = 1;
                                 } else {
                                     //reset in case peer set a lower value, to be tested
-                                    self.dynamic_headers_tc.overflow = 0;
-                                    self.dynamic_headers_ts.overflow = 0;
+                                    dyn_headers.overflow = 0;
                                 }
                             }
                         }

For information, this pcap is the first one I see with asymmetric header table size : 65536 for the client and 4096 for the server
See with Wireshark filter http2.settings.id == 1

But I am not sure how to interpret http2.header_table_size_update

Ah ok, it doesn't seem common for website to use asymmetric table sizes, especially that small, but it's definitely part of the spec. I've tested your patch and it seems to work fine now for the attached pcap, further Instagram browsing and for a few dozen other websites