What the CONTINUATION flood does
Disclosed in 2024, the CONTINUATION flood sends a HEADERS frame without the END_HEADERS flag and then an unbounded run of CONTINUATION frames that also never end the header block. A server that keeps appending to the header list without enforcing a limit during CONTINUATION processing allocates memory indefinitely for a request that never completes — from a single low-bandwidth connection, often without ever logging a request.
How ddos-simulation.com simulates it safely
ddos-simulation.com speaks genuine HTTP/2 to a single verified domain pinned to a public address, opens one stream, and streams fixed dummy header fragments within the domain’s rate limits. The header content is fixed and non-configurable, and the verified domain must serve HTTP/2 for the frames to reach an HTTP/2 stack.
Authorized targets onlyEvery run is bound to one verified domain you have proven you own. Ownership is checked over HTTPS before anything is scheduled, and running traffic against systems you do not own or are not clearly authorized to test may be unlawful. See the Acceptable Use Policy.
What the test exercises
- Whether header-list-size limits are enforced during CONTINUATION processing
- Per-connection memory bounds for an incomplete header block
- How your HTTP/2 stack caps unterminated header streams
- Proxy, load-balancer, and origin behavior under the flood
- Recovery once the connection is closed
When to run an HTTP/2 CONTINUATION flood test
Run an HTTP/2 CONTINUATION flood test when unbounded header buffering is the failure mode you need to rule out.
- You run HTTP/2 servers and want to confirm header-list and CONTINUATION-frame limits are enforced (CVE-2024-27316 class).
- You've updated your HTTP/2 stack and want to verify the fix under an unfinished, endlessly-continued header block.
- A proxy or CDN handles HTTP/2 framing and you need to confirm it caps header state before the origin.
How to run an HTTP/2 CONTINUATION flood test
- Verify your domain. Prove ownership over HTTPS — it is self-service and takes minutes.
- Add the
http2_continuation_flood command to a timeline in the portal and set the rate, duration, and any concurrency limit. - Set health thresholds. Choose the error-rate, latency, or status-code limits at which the test should abort itself.
- Run and watch. Bounded workers are provisioned minutes before start and torn down the moment the last task ends, while metrics stream live.
- Read the results. Review the recorded latency, status codes, and worker timeline to find where your service starts to bend.
Configure an HTTP/2 CONTINUATION flood test in the portal →
Reading the results
Resilient: Header-size and frame-count limits abort the abusive stream early, memory stays flat, and other connections are unaffected.
Under strain: Memory grows without bound as frames arrive, the process approaches out-of-memory, or connection handling stalls under the header pressure.
Availability & limits
The HTTP/2 CONTINUATION flood is priced per engagement — request a quote. Verify your domain before it runs.
Frequently asked questions
What is the CONTINUATION flood?
A 2024 class of HTTP/2 denial-of-service (CVE-2024-27316 and related) in which endless CONTINUATION frames force a server to buffer an ever-growing header block that never completes.
How is it different from Rapid Reset?
Rapid Reset churns many short-lived streams to burn CPU; the CONTINUATION flood holds one stream open and grows its header state, exhausting memory instead.
Rehearse an HTTP/2 CONTINUATION flood test against infrastructure you own — bounded, monitored, and stopped the instant you have your answer.
Build a test plan