Summary
Impact: Denial of Service. Microsoft rating: Important. Not known to be exploited, publicly disclosed before the fix — Exploitation More Likely. Customer action: Required.
Details
What actions should I take to help protect my devices from this vulnerability?
Install the June 2026 Windows security updates listed in the Security Updates table. These updates enable the protections Microsoft released for this CVE.
As part of these updates, Microsoft also introduced a new MaxHeadersCount registry setting. This setting allows you to limit the number of headers included in HTTP/2 and HTTP/3 requests that are accepted by the HTTP server. For more information, see KB5102602.
Security updates
10.0.17763.8880 — https://support.microsoft.com/help/5094123
10.0.19044.7417 — https://support.microsoft.com/help/5094127
10.0.20348.5256 — https://support.microsoft.com/help/5094128
10.0.26100.32995 — https://support.microsoft.com/help/5094125
10.0.26200.8655 — https://support.microsoft.com/help/5094126
10.0.22631.7219 — https://support.microsoft.com/help/5093998
10.0.28000.2269 — https://support.microsoft.com/help/5095051
10.0.14393.9234 — https://support.microsoft.com/help/5094122
Vulnerabilities 1
-
High 7.5
HTTP.sys Denial of Service Vulnerability
Uncontrolled resource consumption in HTTP/2 allows an unauthorized attacker to deny service over a network.
Revision history
-
#1
Information published.
References
-
CVE-2026-49160 HTTP.sys Denial of Service Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49160
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss