CVE-2026-49160: Windows 10 1607 DOS Vulnerability

CVE-2026-49160 Overview

CVE-2026-49160 is an uncontrolled resource consumption vulnerability (CWE-400) in the Microsoft Windows HTTP/2 protocol implementation. An unauthorized remote attacker can send specially crafted HTTP/2 traffic that causes the affected service to exhaust system resources, resulting in denial of service. The flaw affects a broad range of Windows client and server editions, including Windows 10, Windows 11, and Windows Server releases from 2016 through 2025. Microsoft published the advisory on June 9, 2026, and the issue impacts any Windows host exposing HTTP/2 endpoints such as those served by HTTP.sys and Internet Information Services (IIS).

Critical Impact

Network-reachable HTTP/2 services on Windows can be rendered unavailable by an unauthenticated attacker without user interaction, disrupting hosted web applications, APIs, and management interfaces.

Affected Products

• Microsoft Windows 10 (versions 1607, 1809, 21H2, 22H2)
• Microsoft Windows 11 (versions 23H2, 24H2, 25H2, 26H1)
• Microsoft Windows Server 2016, 2019, 2022, and 2025

Discovery Timeline

• 2026-06-09 - CVE-2026-49160 published to NVD and Microsoft Security Update Guide
• 2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-49160

Vulnerability Analysis

The vulnerability resides in the Windows HTTP/2 stack and is classified as uncontrolled resource consumption under CWE-400. HTTP/2 introduces stateful constructs such as streams, headers using HPACK compression, flow-control windows, and dynamic settings frames. Each construct requires the server to allocate memory or CPU cycles to track per-connection state. An attacker can abuse these mechanisms by issuing high volumes of low-cost frames that force the server into disproportionately expensive processing.

The attack is unauthenticated and requires only network access to a reachable HTTP/2 endpoint. Successful exploitation degrades availability without exposing confidentiality or integrity, consistent with the C:N/I:N/A:H impact profile recorded by Microsoft. The EPSS probability of 1.298% places this issue in the 80th percentile of likely-to-be-exploited vulnerabilities, reflecting interest typical of network-reachable DoS flaws in Windows services.

Root Cause

The HTTP/2 implementation fails to bound the resources consumed by adversary-controlled protocol primitives. Patterns historically associated with this class of bug, such as the Rapid Reset attack and excessive SETTINGS, PING, or HEADERS frames, allow attackers to amplify server-side work relative to client-side cost. The component does not adequately throttle or terminate abusive connections before resource exhaustion occurs.

Attack Vector

Exploitation requires only a TCP connection to an HTTP/2 listener and the ability to negotiate the h2 protocol via Application-Layer Protocol Negotiation (ALPN). The attacker then issues malformed or pathological frame sequences over one or more connections. No credentials, user interaction, or pre-existing foothold are required. Internet-exposed IIS hosts, Windows-based reverse proxies, and any service binding to HTTP.sys with HTTP/2 enabled are reachable targets.

No public proof-of-concept code has been released for CVE-2026-49160 at the time of writing. See the Microsoft Security Update CVE-2026-49160 advisory for vendor technical details.

Detection Methods for CVE-2026-49160

Indicators of Compromise

• Sudden spikes in HTTP/2 connection counts or stream creation rates against IIS or other HTTP.sys-backed services
• High volumes of RST_STREAM, SETTINGS, PING, or HEADERS frames originating from a small set of source IPs
• Memory or non-paged pool exhaustion on Windows hosts running web services, visible in System event logs and performance counters
• HTTP.sys errors and connection resets recorded in %SystemRoot%\System32\LogFiles\HTTPERR\

Detection Strategies

• Monitor HTTP/2 frame-rate anomalies at network sensors, load balancers, or WAFs capable of parsing HTTP/2
• Correlate w3wp.exe and System process memory and handle counts with inbound HTTP/2 connection metrics
• Alert on Windows Event IDs related to HTTP.sys service degradation and IIS application pool recycles tied to resource limits

Monitoring Recommendations

• Baseline normal HTTP/2 stream and frame rates per client IP and alert on statistical deviations
• Track \HTTP Service\* and \Web Service\* performance counters for sustained saturation
• Ingest IIS, HTTP.sys, and Windows Defender Firewall logs into a centralized SIEM for correlation across hosts

How to Mitigate CVE-2026-49160

Immediate Actions Required

• Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2026-49160 advisory to all affected Windows 10, Windows 11, and Windows Server hosts
• Inventory internet-exposed services that negotiate HTTP/2 and prioritize patching those systems first
• Place rate limiting and HTTP/2-aware filtering in front of public endpoints until patches are deployed

Patch Information

Microsoft has released security updates for all affected Windows client and server editions. Administrators should consult the Microsoft Security Update CVE-2026-49160 advisory for the specific KB numbers that correspond to each Windows build and deploy them through Windows Update, WSUS, Microsoft Update Catalog, or Intune.

Workarounds

• Disable HTTP/2 on affected IIS sites where the protocol is not required by setting EnableHttp2Tls and EnableHttp2Cleartext to 0 under HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters and restarting HTTP.sys
• Enforce per-IP connection and request-rate limits at upstream load balancers, reverse proxies, or WAFs
• Restrict exposure of management interfaces and non-public HTTP/2 endpoints to trusted networks via firewall rules

# Disable HTTP/2 in HTTP.sys on Windows (PowerShell, run as Administrator)
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\HTTP\Parameters' -Name 'EnableHttp2Tls' -Value 0 -Type DWord
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\HTTP\Parameters' -Name 'EnableHttp2Cleartext' -Value 0 -Type DWord
net stop http /y
net start http