Version 2.0.0-beta1
Pre-release
Pre-release
·
29 commits
to master
since this release
Immutable
release. Only release title and notes can be modified.
First beta of the C++17 rewrite, shipping alongside the existing tool.
Nothing is renamed. slowhttptest is still the 1.10.0 tool you already run.
The rewrite installs next to it as slowhttptest-ng, with its own man page.
slowhttptest-ng -u https://target/ -c 1000 -H
docker run --rm shekyan/slowhttptest:ng -u https://target/ -c 1000 -H
What it adds
- HTTP/2 attacks: slow read (CVE-2019-9517), rapid reset
(CVE-2023-44487), CONTINUATION flood — verified against nginx 1.31.4. - A verdict, not a socket census — HTML and JSON reports that say
whether service was denied, with the caveats that qualify it. - kqueue on macOS/BSD, which is the only way past ~10k connections there.
- Availability probing (
-p), a capacity staircase, and exit code3
meaning nothing was actually tested — the failure that used to pass CI.
Deliberate incompatibilities
Flag compatibility is otherwise complete. Three things differ on purpose:
- CSV output is gone; JSON carries the same event log plus the verdict.
- Exit codes are
2/3rather than-1. - The report is written around availability rather than socket states.
Falling back
Both binaries ship in this release. If slowhttptest-ng doesn't suit you,
slowhttptest is still installed and unchanged — no reinstall, no downgrade.
Marked pre-release deliberately: packaging tooling that follows the latest
release will keep tracking 1.10.0 until the rewrite has had real exposure.