CVE-2026-49160: HTTP.sys Denial of Service Vulnerability

Synopsis

Uncontrolled resource consumption in HTTP.sys, the Windows kernel-mode HTTP request handler, allows a remote unauthenticated attacker to exhaust server resources by sending crafted HTTP/2 traffic over a network connection. No authentication or user interaction is required; the attacker only needs to reach the exposed HTTP/2 service. Successful exploitation crashes or freezes the HTTP.sys request pipeline, denying service to all applications hosted on the affected Windows system. Patched-image rebuilds at the applicable fix versions are available on HarborGuard for environments running an affected Windows version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the target's HTTP/2 service over a network connection; no local access is needed, but the service must be reachable.

• AuthenticationNot required

  No credentials or account of any privilege level are required; the attack works anonymously.

• Victim interactionNot required

  No action by a logged-in user or administrator is needed to trigger the vulnerability.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions or special environmental factors are required, making repeated attempts straightforward.

Blast Radius

• Crashes or stalls the HTTP.sys request pipeline, taking down all HTTP/HTTPS applications hosted on the affected Windows system.
• Disrupts any service that relies on HTTP.sys for request handling, including IIS-hosted APIs and Windows container workloads exposing HTTP/2 endpoints.
• No confidentiality or data-integrity impact: the attacker cannot read or modify stored data, only force a service outage.