CVE-2026-33096: Windows HTTP.sys DoS Vulnerability

CVE-2026-33096 Overview

CVE-2026-33096 is an out-of-bounds read vulnerability in Windows HTTP.sys that allows an unauthorized attacker to cause a denial of service over a network. This vulnerability exists in the HTTP protocol stack (HTTP.sys), a kernel-mode driver responsible for processing HTTP requests in Windows. By sending specially crafted network requests, an unauthenticated remote attacker can trigger an out-of-bounds read condition, causing the affected system to become unresponsive.

Critical Impact

Remote attackers can exploit this vulnerability without authentication to cause denial of service conditions on Windows systems running HTTP.sys, potentially disrupting web services, IIS servers, and other HTTP-dependent applications.

Affected Products

• Windows HTTP.sys (HTTP Protocol Stack)
• Windows Server systems running IIS
• Windows systems with HTTP.sys enabled services

Discovery Timeline

• April 14, 2026 - CVE-2026-33096 published to NVD
• April 14, 2026 - Last updated in NVD database

Technical Details for CVE-2026-33096

Vulnerability Analysis

This vulnerability is classified as CWE-125 (Out-of-bounds Read), a memory safety issue where the HTTP.sys driver reads data from memory locations outside the intended buffer boundaries. HTTP.sys is a critical Windows component that operates in kernel mode and handles HTTP request parsing for services like Internet Information Services (IIS), Windows Remote Management (WinRM), and WSDAPI.

When processing malformed HTTP requests, HTTP.sys fails to properly validate input boundaries before performing read operations. This allows an attacker to trigger read operations that access memory beyond the allocated buffer, leading to system instability and denial of service conditions. Since HTTP.sys operates in kernel mode, crashes caused by this vulnerability result in system-wide impact rather than just application-level failures.

The network-accessible nature of this vulnerability makes it particularly concerning for internet-facing Windows servers. No user interaction or authentication is required to exploit this flaw.

Root Cause

The root cause is improper bounds checking in the HTTP.sys driver when parsing HTTP request data. The driver fails to adequately validate the length or boundaries of input data before performing memory read operations, allowing crafted requests to cause out-of-bounds memory access. This is a classic input validation failure where untrusted network data is processed without sufficient safety checks.

Attack Vector

The attack can be executed remotely over the network without requiring authentication or user interaction. An attacker sends specially crafted HTTP requests to a vulnerable Windows system running HTTP.sys. The malformed request triggers the out-of-bounds read condition in kernel mode, causing the system to crash or become unresponsive.

The attack is particularly effective against:

• Windows servers running IIS web services
• Systems with WinRM (Windows Remote Management) enabled
• Any Windows service utilizing HTTP.sys for HTTP processing

Since no verified code examples are available for this vulnerability, organizations should refer to the Microsoft CVE-2026-33096 Advisory for detailed technical information about the exploitation mechanism and recommended mitigations.

Detection Methods for CVE-2026-33096

Indicators of Compromise

• Unexpected system crashes or blue screens (BSOD) with HTTP.sys related error codes
• Unusual HTTP request patterns in IIS or HTTP.sys logs showing malformed requests
• System event logs indicating kernel-mode driver failures in http.sys
• Network traffic analysis revealing abnormal HTTP request structures or sizes

Detection Strategies

• Monitor Windows Event Logs for HTTP.sys related crashes and errors (Event ID 15021 and similar)
• Implement network intrusion detection rules to identify malformed HTTP requests targeting HTTP.sys
• Deploy endpoint detection solutions to monitor for kernel-mode crashes and unexpected system behavior
• Analyze HTTP access logs for requests with unusual headers or malformed content

Monitoring Recommendations

• Enable verbose logging for IIS and HTTP.sys to capture detailed request information
• Configure alerts for system stability issues, particularly BSOD events related to network drivers
• Implement network monitoring for unusual traffic patterns targeting HTTP/HTTPS ports
• Use SentinelOne's behavioral AI to detect anomalous kernel-mode activity and system crashes

How to Mitigate CVE-2026-33096

Immediate Actions Required

• Apply the latest Windows security updates from Microsoft as soon as available
• Review and restrict network access to HTTP.sys services where possible using firewall rules
• Implement Web Application Firewall (WAF) rules to filter malformed HTTP requests
• Monitor systems for signs of exploitation attempts while awaiting patches

Patch Information

Microsoft has released security guidance for this vulnerability. Organizations should consult the Microsoft CVE-2026-33096 Advisory for official patch information and apply the recommended Windows updates through Windows Update, WSUS, or Microsoft Update Catalog.

Workarounds

• Limit network exposure of systems running HTTP.sys by placing them behind reverse proxies or load balancers that can filter malicious requests
• Disable HTTP.sys on systems where it is not required for business operations
• Implement rate limiting and request validation at the network perimeter to reduce exposure
• Consider using SentinelOne Singularity platform for real-time protection against exploitation attempts

# Check if HTTP.sys is running and review its status
sc query http

# Review HTTP.sys URL reservations
netsh http show urlacl

# Configure Windows Firewall to restrict HTTP.sys access (example - adjust ports as needed)
netsh advfirewall firewall add rule name="Block External HTTP.sys Access" dir=in action=block protocol=tcp localport=80,443 remoteip=any