# DoS for HTTP/2 connections by crafted requests (CVE-2018-1333)

Crafted HTTP/2 (h2c) requests make Apache mod_http2 worker threads hang until timeout, letting a slow attacker exhaust the worker pool and deny service.

- Payout: hidden
- Severity: medium
- Program: Internet Bug Bounty
- Found by (vendor credit): Craig Young of Tripwire VERT
- Found by: cy1337
- Disclosed: 2018-10-28
- CVE: CVE-2018-1333
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/384839
- Library page: https://bugbountylibrary.com/r/h1%3A384839
- Tags: area:web domain:oss domain:web impact:dos kind:bounty platform:hackerone sev:medium technique:fuzzing vuln:dos

**Target:** Apache mod_http2 (h2c) endpoint
**Root cause:** mod_http2 holds server worker threads open waiting for more data on specially crafted HTTP/2 requests instead of releasing them, so each request ties up a worker until the configured timeout.
**Steps:**
1. Enable h2c on the target Apache server.
2. Send the crafted HTTP/2 preface/frame hex payload repeatedly: `for x in \`seq 0 500\`; do echo 505249202a20485454502f322e300d0a0d0a534d0d0a0d0a00001204000000000000000000006400044000000000020000000000001b0104000000018284864187089d5c0b8178ff7a8825b650c3abb6f2e053032a2f2a00001b0105000000019a84864187089d5c0b8178ff7a880000000000000000 | xxd -r -p | nc hostname port 2>&1 >/dev/null & done`
3. At 3-4 requests/second, worker threads accumulate waiting for data until the 1-minute timeout, exhausting the ~150-worker pool.
**How found:** Fuzzing mod_http2 with afl-fuzz surfaced crafted HTTP/2 requests that kept worker threads waiting for data until timeout.
**Exploitation:** Attacker opens many short crafted h2c connections at a low rate; each consumes a worker thread blocked until timeout, so with a 150-worker/1-minute-timeout config the pool fills and legitimate users get no service.
**Insight:** When fuzzing HTTP/2 servers, watch for requests that leave connections/threads in a waiting state rather than completing or erroring; per-connection worker blocking turns a low request rate into full pool exhaustion.