ddos-sim.com All simulations Build a test plan

Layer 7 · Application · http2_continuation_flood

HTTP/2 CONTINUATION flood test

The http2_continuation_flood simulation opens an HTTP/2 request whose header block is never finished and streams CONTINUATION frames without end — the 2024 CONTINUATION-flood class (CVE-2024-27316 and related) — against a domain you own, to see whether your stack buffers header state without bound.

Layer L7 Protocol HTTP/2 Command http2_continuation_flood Access Quote on request

What the CONTINUATION flood does

Disclosed in 2024, the CONTINUATION flood sends a HEADERS frame without the END_HEADERS flag and then an unbounded run of CONTINUATION frames that also never end the header block. A server that keeps appending to the header list without enforcing a limit during CONTINUATION processing allocates memory indefinitely for a request that never completes — from a single low-bandwidth connection, often without ever logging a request.

How ddos-sim.com simulates it safely

ddos-sim.com speaks genuine HTTP/2 to a single verified domain pinned to a public address, opens one stream, and streams fixed dummy header fragments within the domain’s rate limits. The header content is fixed and non-configurable, and the verified domain must serve HTTP/2 for the frames to reach an HTTP/2 stack.

Authorized targets only

Every run is bound to one verified domain you have proven you own. Ownership is checked over HTTPS before anything is scheduled, and running traffic against systems you do not own or are not clearly authorized to test may be unlawful. See the Acceptable Use Policy.

What the test exercises

  • Whether header-list-size limits are enforced during CONTINUATION processing
  • Per-connection memory bounds for an incomplete header block
  • How your HTTP/2 stack caps unterminated header streams
  • Proxy, load-balancer, and origin behavior under the flood
  • Recovery once the connection is closed

How to run an HTTP/2 CONTINUATION flood test

  1. Verify your domain. Prove ownership over HTTPS — it is self-service and takes minutes.
  2. Add the http2_continuation_flood command to a timeline in the portal and set the rate, duration, and any concurrency limit.
  3. Set health thresholds. Choose the error-rate, latency, or status-code limits at which the test should abort itself.
  4. Run and watch. Bounded workers are provisioned minutes before start and torn down the moment the last task ends, while metrics stream live.
  5. Read the results. Review the recorded latency, status codes, and worker timeline to find where your service starts to bend.

Configure an HTTP/2 CONTINUATION flood test in the portal →

Availability & limits

The HTTP/2 CONTINUATION flood is priced per engagement — request a quote. Verify your domain before it runs.

Frequently asked questions

What is the CONTINUATION flood?

A 2024 class of HTTP/2 denial-of-service (CVE-2024-27316 and related) in which endless CONTINUATION frames force a server to buffer an ever-growing header block that never completes.

How is it different from Rapid Reset?

Rapid Reset churns many short-lived streams to burn CPU; the CONTINUATION flood holds one stream open and grows its header state, exhausting memory instead.

Rehearse an HTTP/2 CONTINUATION flood test against infrastructure you own — bounded, monitored, and stopped the instant you have your answer.

Build a test plan
← All DDoS simulations