“During CONTINUATION Flood attack not a single request is made (no END_HEADERS flag)!”
Send HEADERS, then CONTINUATION frames, and never set the flag that says you’re done. Apache httpd, Envoy, Go and Node.js all failed to cap or time out the stream properly. In many cases one TCP connection was enough to crash the server. The attack never shows up in access logs, so the admin watching the box goes down sees nothing.