Loading vulnerability…
Windows HTTP.sys Out-of-Bounds Read Denial of Service
CVE-2026-33096 is an out-of-bounds read vulnerability in Windows HTTP.sys that allows an unauthenticated attacker to cause denial of service over a network. The vulnerability is rated 7.5 (High). A laboratory demonstration associated with this CVE reportedly crashed an HTTP/3 server using a few packets, but the relationship between that demonstration's kernel QUIC handling and the HTTP.sys vulnerability remains unconfirmed.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Remote exploitation can disrupt availability of an affected Windows system or HTTP service. The associated laboratory demonstration reportedly caused server crashes and restarts, with repeated triggering sustaining denial of service. Code execution and data theft have not been demonstrated for this vulnerability.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure of systems that accept untrusted network traffic through HTTP.sys by limiting network access to required sources only and minimizing externally reachable HTTP services on affected hosts. No specific vendor workaround is available in the provided information.
Patch, then assume compromise.
Apply the Microsoft security update addressing CVE-2026-33096 for the affected Windows release, or a superseding cumulative update. A fix is available, but the exact update identifiers and affected-version matrix are not specified, and the reported initial release date conflicts between April and May 2026.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.