PT-2026-48117 · Microsoft · Windows

CVE-2026-49160

·

Published

2026-06-09

·

Updated

2026-07-09

CVSS v2.0

7.8

High

VectorAV:N/AC:L/Au:N/C:N/I:N/A:C
Name of the Vulnerable Software and Affected Versions Windows HTTP.sys (affected versions not specified)
Description An unauthenticated remote attacker can cause a denial of service in the Windows kernel-mode web listener core (HTTP.sys) by exploiting uncontrolled resource consumption in HTTP/2. The issue stems from the abuse of HPACK header compression tables and stream flow control states, where a small malicious ingress packet can be expanded into a multi-megabyte plaintext block within the host's kernel memory space. This asymmetric memory amplification can exhaust the kernel memory pool, leading to an instantaneous crash of all adjacent services sharing the component, such as Microsoft IIS web applications and Exchange Server pipelines.
Recommendations As a mitigation measure, implement the following Windows Registry modifications under HKLM:SystemCurrentControlSetServicesHTTPParameters:
  • Set MaxHeadersCount to 64 to cap the number of header properties per request frame.
  • Set MaxFieldLength to 16384 to limit memory expansion loops.
  • Set MaxRequestBytes to 32768 to cap the total allowed byte sizing for request headers.
  • Restart the HTTP driver infrastructure to apply these parameters.

Fix

DoS

LPE

Resource Exhaustion

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-400

Related Identifiers

BDU:2026-08063
CVE-2026-49160

Affected Products

Windows