CVE-2026-49787 Overview
CVE-2026-49787 is a denial-of-service vulnerability affecting the Windows HTTP protocol stack (HTTP.sys). The flaw stems from the allocation of resources without limits or throttling, classified under [CWE-770]. An unauthenticated remote attacker can send crafted HTTP traffic over the network to exhaust system resources and disrupt service availability. Microsoft published the advisory on July 14, 2026, and the issue impacts a broad range of Windows client and server editions that expose HTTP.sys functionality. Because HTTP.sys underpins Internet Information Services (IIS) and many higher-level services such as WinRM and WSUS, successful exploitation can cascade across dependent workloads.
Critical Impact
Unauthenticated attackers can remotely trigger resource exhaustion in HTTP.sys, causing denial of service across affected Windows hosts.
Affected Products
- Microsoft Windows 10 (versions 1607, 1809, 21H2, 22H2) across x86, x64, and ARM64
- Microsoft Windows 11 (versions 24H2, 25H2, 26H1) across x64 and ARM64
- Microsoft Windows Server 2016, 2019, 2022, and 2025
Discovery Timeline
- 2026-07-14 - CVE-2026-49787 published to NVD
- 2026-07-20 - Last updated in NVD database
Technical Details for CVE-2026-49787
Vulnerability Analysis
The vulnerability resides in HTTP.sys, the kernel-mode driver that processes HTTP and HTTPS requests for Windows. HTTP.sys handles request parsing, connection queuing, and response buffering on behalf of user-mode services such as IIS. When the driver receives incoming requests, it fails to properly bound resource consumption, allowing a remote client to force allocations that outpace the system's capacity. The Common Weakness Enumeration [CWE-770] categorizes this as allocation of resources without limits or throttling.
Because HTTP.sys runs in kernel space, resource exhaustion can degrade or halt the entire host, not just the web service. Attackers do not need credentials or user interaction to trigger the condition.
Root Cause
The driver does not enforce sufficient upper bounds on the number or size of resources allocated per client, per connection, or per request. Repeated or malformed requests cause internal structures to grow until memory, non-paged pool, or worker threads are depleted. This design flaw allows an attacker to convert a small volume of network traffic into disproportionate resource consumption on the target.
Attack Vector
Exploitation requires network reachability to a listening HTTP.sys endpoint. Any Windows host running IIS, WinRM, WSUS, Print Services on HTTP, or a custom application built on HttpApi may be exposed. An attacker sends a stream of crafted HTTP requests that trigger unbounded allocations inside the driver. Once resources are exhausted, the service stops accepting connections, and in severe cases the host becomes unresponsive until restart.
No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Microsoft CVE-2026-49787 Advisory for vendor-specific technical detail.
Detection Methods for CVE-2026-49787
Indicators of Compromise
- Sudden spikes in non-paged pool consumption on hosts running HTTP.sys-based services
- IIS or dependent HTTP services becoming unresponsive without corresponding application errors
- Elevated inbound HTTP/HTTPS connection counts from a small set of remote source addresses
Detection Strategies
- Monitor Windows Performance counters for HTTP Service Request Queues and Memory\Pool Nonpaged Bytes to catch abnormal growth
- Inspect HTTPERR logs under %SystemRoot%\System32\LogFiles\HTTPERR for large numbers of Connection_Dropped or Timer_ConnectionIdle entries
- Correlate network telemetry for repeated malformed or oversized HTTP requests targeting Windows web endpoints
Monitoring Recommendations
- Baseline normal request volumes per source IP against IIS and other HTTP.sys consumers, and alert on statistical deviations
- Ingest Windows Event Log channels for HttpEvent and IIS worker process crashes into a centralized SIEM for correlation
- Track availability of exposed HTTP endpoints through synthetic monitoring to identify service degradation early
How to Mitigate CVE-2026-49787
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft CVE-2026-49787 Advisory to all affected Windows client and server systems
- Inventory internet-facing hosts running IIS, WinRM, WSUS, or other HTTP.sys-based services and prioritize them for patching
- Restrict inbound access to management HTTP endpoints such as WinRM (ports 5985/5986) to trusted networks only
Patch Information
Microsoft has released a security update addressing CVE-2026-49787. Administrators should install the update through Windows Update, WSUS, or Microsoft Update Catalog per the vendor advisory. Server workloads should be patched during a scheduled maintenance window, and reboot requirements should be verified in the update details.
Workarounds
- Place affected servers behind a reverse proxy or web application firewall configured to enforce request rate limits and reject malformed HTTP traffic
- Configure IIS <limits> settings such as connectionTimeout, maxBandwidth, and maxConnections to constrain per-site resource use
- Disable unused HTTP.sys-based services on hosts that do not require them to reduce the attack surface
# Example: constrain IIS site limits via appcmd
appcmd set config "Default Web Site" -section:system.applicationHost/sites /[name='Default Web Site'].limits.maxConnections:1000 /[name='Default Web Site'].limits.connectionTimeout:00:00:30 /commit:apphost
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
