Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2026-11118-HTTP-2-Rapid-Reset-DDoS — Python PoC for CVE-2026-11118 demonstrating HTTP/2 Rapid Reset DDoS via RST_STREAM resource exhaustion; includes vulnerable server simulator and exploit client. | Kitploit
Tools/GitHubGitHub/george0papasotiriou/cve-2026-11118-http-2-rapid-reset-ddos
Vulnerability AnalysisExploitationWeb SecurityNetwork Security
GitHubgeorge0papasotiriou/cve-2026-11118-http-2-rapid-reset-ddos

CVE-2026-11118-HTTP-2-Rapid-Reset-DDoS

Python PoC for CVE-2026-11118 demonstrating HTTP/2 Rapid Reset DDoS via RST_STREAM resource exhaustion; includes vulnerable server simulator and exploit client.

View Repository
21 month agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2026-11118 – HTTP/2 Rapid Reset DDoS

Program Code (Python/http2 client + server)

root@kitploit:~
# http2_server_sim.py - Simple HTTP/2 server that processes reset streams
import socket, ssl, h2.connection, h2.events

def handle():
    sock = socket.socket()
    sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
    sock.bind(('0.0.0.0', 8443))
    sock.listen(5)
    conn, addr = sock.accept()
    ctx = ssl.create_default_context(ssl.Purpose.CLIENT_AUTH)
    ctx.load_cert_chain('cert.pem', 'key.pem')
    tls = ctx.wrap_socket(conn, server_side=True)
    h2conn = h2.connection.H2Connection(client_side=False)
    h2conn.initiate_connection()
    tls.sendall(h2conn.data_to_send())
    while True:
        data = tls.recv(65535)
        events = h2conn.receive_data(data)
        for event in events:
            if isinstance(event, h2.events.RequestReceived):
                # Start processing, but quickly reset if too many
                h2conn.reset_stream(event.stream_id)
                print("Reset stream")
        tls.sendall(h2conn.data_to_send())

# (Run in a thread)

CVE-2026-11118 – HTTP/2 Rapid Reset DDoS Attack

Severity: High

Overview

An HTTP/2 server does not limit the rate of stream resets (RST_STREAM frames). An attacker can open a large number of streams and immediately reset them, causing excessive server resource consumption without having to complete any requests, leading to denial of service.

Vulnerability Details

  • Type: Denial of Service
  • Impact: Server resource exhaustion, downtime.
  • Root Cause: The server processes stream resets without tracking the cost, allowing an unlimited number of reset frames per connection.

Exploit Demonstration

  1. Start the vulnerable HTTP/2 server (requires generating TLS certs):
    root@kitploit:~
    openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes
    python http2_server_sim.py
    
  2. Run the exploit:
    root@kitploit:~
    python exploit_http2_rapid_reset.py
    

The server becomes unresponsive due to high reset rate.

Download Tool