Loading story…
Microsoft disclosed CVE-2026-49160, an Important denial-of-service flaw in HTTP.sys that stems from uncontrolled resource consumption during HTTP/2 processing. The vulnerability can be triggered remotely by an unauthenticated attacker with no user interaction, allowing service disruption over the network, and Microsoft assigned it a CVSS 3.1 score of 7.5. The company said the issue had been publicly disclosed but had not been exploited at publication, while rating exploitation as more likely.
Microsoft said the fix is included in the June 2026 Windows security updates and introduced a new registry setting, MaxHeadersCount, to limit the number of headers accepted in HTTP/2 and HTTP/3 requests handled by the Windows HTTP server. According to Microsoft support guidance, administrators can configure the REG_DWORD value under HTTP service parameters after installing the update; the default is 200, with a minimum of 50 and a maximum of 65535, and a system restart is required for changes to take effect. Microsoft said the control is intended to reduce excessive memory use, high CPU consumption, and denial-of-service conditions, and noted that MaxRequestBytes may still impose a higher effective header limit in some cases.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
On 2026-06-09, Microsoft published KB5102602 documenting the new MaxHeadersCount registry setting for limiting HTTP/2 and HTTP/3 headers accepted by HTTP.sys. Microsoft said the setting is available after installing Windows updates released on or after that date and is intended to reduce denial-of-service risk from excessive header processing.
On 2026-06-09, Microsoft disclosed CVE-2026-49160, an Important HTTP.sys denial-of-service vulnerability caused by uncontrolled resource consumption in HTTP/2. Microsoft said the issue was publicly disclosed but not exploited at publication time and advised installing the June 2026 Windows security updates.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
msrc.microsoft.com
Open sourcesupport.microsoft.com
Open sourcetheregister.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft patched **`CVE-2026-47291`**, a remotely exploitable flaw in **Windows `HTTP.sys`** that can cause denial of service or potentially **kernel-level remote code execution** on systems using the HTTP protocol stack behind IIS and other applications. The bug stems from an **integer overflow** while `HTTP.sys` expands a per-request buffer reference array during **HTTP/1.x header parsing over TLS**; the array's 16-bit capacity can wrap to zero, leading to a large **kernel pool heap buffer overflow** during memory movement operations. Exploitation requires a remote, unauthenticated attacker to send a specially crafted **HTTPS** request with many header lines, placing each header in a separate **TLS application data record** so each becomes a distinct buffer reference. The issue is described as reachable only on the **HTTP/1.x over TLS** path, not the HTTP/2 or HTTP/3 parser paths, and it depends on the target accepting an unusually large request; keeping the **`MaxRequestBytes`** registry setting at or below **65,535 bytes** is cited as a practical mitigation, while applying Microsoft's June 2026 patch is the recommended fix. Detection guidance includes inspecting decrypted HTTPS traffic for excessive HTTP/1.x header lines or, without decryption, looking for sustained connections carrying many small TLS application data records.
Jul 11, 2026
A newly disclosed denial-of-service vulnerability dubbed **HTTP/2 Bomb** (`CVE-2026-49975`) can let unauthenticated attackers crash vulnerable servers by abusing HTTP/2 header compression and flow-control behavior to amplify small requests into large in-memory allocations. Researchers said the flaw affects widely deployed infrastructure including **nginx**, **Apache httpd**, **Microsoft IIS**, **Envoy**, and **Cloudflare Pingora**, with early Internet scans identifying more than **880,000** potentially exposed websites. Security firms reported reconnaissance activity in the wild, and sectors with large numbers of Internet-facing systems—especially **telecommunications, IT, and healthcare**—were flagged as particularly exposed. A public proof-of-concept is now available for **Apache HTTP Server**, where affected versions **2.4.17 through 2.4.67** can be forced into sustained memory exhaustion through crafted HTTP/2 cookie headers and a zero-window flow-control technique that prevents resources from being released. Apache fixed the issue in **2.4.68**, while other vendors have rolled out patches or mitigations on uneven timelines, including earlier fixes from nginx and Apache, a next-day patch from Envoy, a later mitigation from Microsoft, and no patch yet reported for Cloudflare at the time of coverage. Defenders are being urged to **upgrade immediately**, consider temporarily disabling HTTP/2 where feasible, and watch for abnormal memory growth and other signs of attempted DoS activity.
Jun 29, 2026
Researchers publicly disclosed **HTTP/2 Bomb**, a remote denial-of-service technique that abuses standard HTTP/2 behavior to rapidly exhaust memory on major web servers and proxies, including **nginx, Apache HTTP Server, Microsoft IIS, Envoy, and Cloudflare Pingora**. The attack combines **HPACK header-compression amplification** with a **Slowloris-style flow-control stall**, letting a low-bandwidth client trigger disproportionate server-side allocations and keep that memory pinned by advertising a zero-byte window. Reports said a single machine on a 100 Mbps connection could make vulnerable services inaccessible within seconds, with testing showing **Apache httpd** and **Envoy** consuming roughly **32 GB of RAM** in about **10 to 20 seconds** under default HTTP/2 configurations. Public disclosures and proof-of-concept code indicated the amplification largely comes from per-header bookkeeping rather than oversized decoded header values, allowing common decoded-size limits to be bypassed. **Apache** tracked its exposure as **`CVE-2026-49975`** and released a fix in **`mod_http2 2.0.41`**, while **nginx** addressed the issue in **`1.29.8`**; advisories initially said **IIS, Envoy, and Pingora** lacked patches, though later disclosures showed **Envoy** assigned **`CVE-2026-47774`** and published an advisory. Researchers estimated more than **880,000** internet-exposed HTTP/2 systems could be affected and recommended upgrading where fixes exist, or otherwise disabling HTTP/2, enforcing strict header-count limits, and monitoring for abnormal memory growth.
Jun 29, 2026