MSRC-CVE-2023-35298 — HTTP.sys Denial of Service Vulnerability

Summary

Impact: Denial of Service. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

How could an attacker exploit this vulnerability?
In most situations, an unauthenticated attacker could send a specially crafted packet to a targeted server utilizing the Server Name Indication (SNI) over HTTP Protocol Stack (http.sys) to process packets, causing a denial of service (DOS).

Security updates
10.0.20348.1850 — https://support.microsoft.com/help/5028171
10.0.22000.2176 — https://support.microsoft.com/help/5028182
10.0.22621.1992 — https://support.microsoft.com/help/5028185

Vulnerabilities 1

High 7.5

CVE-2023-35298

HTTP.sys Denial of Service Vulnerability

HTTP.sys Denial of Service Vulnerability

Microsoft Windows Server 2022 Windows 11 version 22H2 Windows 11 version 21H2 Windows

Jul 11, 2023

Revision history

2023-07-11 #1
Information published.

References

CVE-2023-35298 HTTP.sys Denial of Service Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35298
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
Common Vulnerability Scoring System
https://www.first.org/cvss