CVE-2026-49160

Name of the Vulnerable Software and Affected Versions Windows HTTP.sys (affected versions not specified)

Description An unauthenticated remote attacker can cause a denial of service in the Windows kernel-mode web listener core (HTTP.sys) by exploiting uncontrolled resource consumption in HTTP/2. The issue stems from the abuse of HPACK header compression tables and stream flow control states, where a small malicious ingress packet can be expanded into a multi-megabyte plaintext block within the host's kernel memory space. This asymmetric memory amplification can exhaust the kernel memory pool, leading to an instantaneous crash of all adjacent services sharing the component, such as Microsoft IIS web applications and Exchange Server pipelines.

Recommendations As a mitigation measure, implement the following Windows Registry modifications under HKLM:SystemCurrentControlSetServicesHTTPParameters: