
Python PoC for CVE-2026-11118 demonstrating HTTP/2 Rapid Reset DDoS via RST_STREAM resource exhaustion; includes vulnerable server simulator and exploit client.
# http2_server_sim.py - Simple HTTP/2 server that processes reset streams
import socket, ssl, h2.connection, h2.events
def handle():
sock = socket.socket()
sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
sock.bind(('0.0.0.0', 8443))
sock.listen(5)
conn, addr = sock.accept()
ctx = ssl.create_default_context(ssl.Purpose.CLIENT_AUTH)
ctx.load_cert_chain('cert.pem', 'key.pem')
tls = ctx.wrap_socket(conn, server_side=True)
h2conn = h2.connection.H2Connection(client_side=False)
h2conn.initiate_connection()
tls.sendall(h2conn.data_to_send())
while True:
data = tls.recv(65535)
events = h2conn.receive_data(data)
for event in events:
if isinstance(event, h2.events.RequestReceived):
# Start processing, but quickly reset if too many
h2conn.reset_stream(event.stream_id)
print("Reset stream")
tls.sendall(h2conn.data_to_send())
# (Run in a thread)
An HTTP/2 server does not limit the rate of stream resets (RST_STREAM frames). An attacker can open a large number of streams and immediately reset them, causing excessive server resource consumption without having to complete any requests, leading to denial of service.
openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes
python http2_server_sim.py
python exploit_http2_rapid_reset.py
The server becomes unresponsive due to high reset rate.