ddos-simulation.com
Build a test plan

Layer 7 · Web Server · Apache HTTP Server

Apache HTTP Server Resilience & CVE Suite

A dedicated suite of authorized resilience simulations evaluating Apache HTTP Server and Apache HttpCore module stability, error boundaries, memory pooling, and mitigation defenses against known CVE regression vectors.

Target Apache HTTP Server / HttpCore Layer L7 Techniques 9 simulations Access Self-service / Quote

Suite Overview

Apache HTTP Server powers critical web and reverse proxy workloads worldwide. This suite evaluates whether your Apache instances, custom module configurations, and reverse proxy chains maintain availability when probed with edge-case URI encodings, recursive rewrite rules, and HPACK decompression sequences.

Apache mod_rewrite Crash (CVE-2024-38477)

cve_2024_38477 — Tests mod_rewrite substitution handling under encoded characters and null-byte variations to verify worker crash protection.

Apache mod_proxy NULL Dereference (CVE-2024-38474)

cve_2024_38474 — Probes mod_proxy backend forwarding when handling atypical request URI encodings to confirm pointer validation safety.

Apache mod_rewrite Loop (CVE-2024-38476)

cve_2024_38476 — Tests internal subrequest and redirect iteration limits in mod_rewrite to prevent CPU exhaustion loops.

Apache mod_proxy Split-URI Crash (CVE-2024-39338)

cve_2024_39338 — Evaluates mod_proxy split-URI parsing logic under crafted path delimiters.

Apache mod_rewrite Target Bypass (CVE-2024-39573)

cve_2024_39573 — Verifies mod_rewrite handler bounds when processing non-canonical filesystem paths.

Apache Windows UNC Path Crash (CVE-2024-38472)

cve_2024_38472 — Probes Windows Apache installations against UNC network path dereference vulnerabilities.

Apache mod_lua Handler Hang (CVE-2024-40898)

cve_2024_40898 — Tests mod_lua script execution timeout enforcement and memory release under stalled request handlers.

Apache HTTP/2 Bomb Memory Exhaustion (CVE-2026-49975)

cve_2026_49975 — Chains HPACK dynamic compression inflation with flow-control holds to evaluate Apache mod_http2 memory limits.

Apache HttpCore HPACK Decoder Overflow (CVE-2026-54428)

cve_2026_54428 — Streams crafted HPACK dynamic table state modifications to test Apache HttpComponents decoder buffer bounds.

Safe Execution & Monitoring

All simulations are run against verified target domains with automated origin health monitoring. If response latency exceeds your configured threshold, the simulation aborts immediately.

Rehearse Apache resilience against infrastructure you own.

Build a test plan
← All DDoS simulations