Skip to content

Version 2.0.0-beta1

Pre-release
Pre-release

Choose a tag to compare

@shekyan shekyan released this 28 Aug 06:56
· 29 commits to master since this release
Immutable release. Only release title and notes can be modified.
4be6efc

First beta of the C++17 rewrite, shipping alongside the existing tool.

Nothing is renamed. slowhttptest is still the 1.10.0 tool you already run.
The rewrite installs next to it as slowhttptest-ng, with its own man page.

slowhttptest-ng -u https://target/ -c 1000 -H
docker run --rm shekyan/slowhttptest:ng -u https://target/ -c 1000 -H

What it adds

  • HTTP/2 attacks: slow read (CVE-2019-9517), rapid reset
    (CVE-2023-44487), CONTINUATION flood — verified against nginx 1.31.4.
  • A verdict, not a socket census — HTML and JSON reports that say
    whether service was denied, with the caveats that qualify it.
  • kqueue on macOS/BSD, which is the only way past ~10k connections there.
  • Availability probing (-p), a capacity staircase, and exit code 3
    meaning nothing was actually tested — the failure that used to pass CI.

Deliberate incompatibilities

Flag compatibility is otherwise complete. Three things differ on purpose:

  • CSV output is gone; JSON carries the same event log plus the verdict.
  • Exit codes are 2/3 rather than -1.
  • The report is written around availability rather than socket states.

Falling back

Both binaries ship in this release. If slowhttptest-ng doesn't suit you,
slowhttptest is still installed and unchanged — no reinstall, no downgrade.

Marked pre-release deliberately: packaging tooling that follows the latest
release will keep tracking 1.10.0 until the rewrite has had real exposure.