Loading vulnerability…
CVE-2026-47291 is a critical unauthenticated remote code execution vulnerability in the Windows HTTP Protocol Stack, HTTP.sys. The flaw arises during HTTP/1.x header parsing over TLS when HTTP.sys expands a per-request buffer-reference array. Its 16-bit capacity field is increased without an overflow check; after sufficient growth operations, the value wraps to zero. HTTP.sys subsequently allocates an undersized kernel-pool buffer while copying the existing reference array, causing a large heap-based buffer overflow. The issue is also associated with CWE-122, Heap-based Buffer Overflow.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
Small PoC repository with two files: a README describing claimed HTTP.sys issues (CVE-2026-49160 and CVE-2026-47291) and one Python exploit/probe script, http2_bomb.py. The Python script is the main artifact. It uses Python's ssl/socket libraries plus the hyper-h2 library to establish a TLS connection, require ALPN negotiation of HTTP/2 ('h2'), initiate an HTTP/2 session, and send a single GET request containing the 4 required pseudo-headers plus a user-controlled number of additional regular headers (default 20, named x-fooooooo-XXXX). It then reads and prints HTTP/2 events such as response headers, data, stream end, stream reset, or connection termination. The exploit capability is therefore a network/web-layer malformed-or-stress request generator aimed at exercising vulnerable HTTP/2 header handling in HTTP.sys, potentially for denial-of-service testing or vulnerability triggering. There is no shellcode, command execution, persistence, or follow-on payload. The README also includes a separate illustrative Python snippet that slowly sends a very large number of HTTP/1.1 headers to hello.lab over TLS and claims this can increment an internal counter toward overflow for CVE-2026-47291, but that snippet is documentation only and not present as a runnable repository file. Overall, this is a proof-of-concept network exploit repository focused on triggering or probing HTTP.sys request-header parsing behavior over HTTPS/HTTP2 rather than achieving post-exploitation control.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
52 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A critical unauthenticated remote code execution vulnerability in the Windows HTTP protocol stack (HTTP.sys), caused by an integer overflow and potentially enabling arbitrary code execution with SYSTEM privileges.
A patched remote code execution vulnerability in the Windows HTTP.sys HTTP protocol stack caused by an integer overflow during HTTP/1.x header parsing over TLS, which can lead to kernel pool heap buffer overflow, denial of service, and potentially arbitrary code execution with kernel privileges.
A critical remote code execution vulnerability in Windows HTTP.sys, exploitable remotely through specially crafted requests.
A critical remote code execution vulnerability in Microsoft's HTTP.sys / Windows HTTP Protocol Stack caused by an integer overflow or wraparound error, allowing remote attackers to execute code by sending a specially crafted malicious packet to a target server.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.