HighPublic exploitVulnerability

CVE-2026-49160

HTTP/2 Bomb in Windows HTTP.sys

Published Jun 9, 2026 · Updated 1 month ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 daysNo mention activity in the last 30 days.

CVSS7.5High · v3.1

EPSS56.6%99th percentile

CISA KEVNoNot listed

In the wildReported2 exploitation records in Mallory

Vendor: Microsoft Corporation

IdentifiersCVE-2026-49160CWE-400 · Uncontrolled Resource Consumption

CVE-2026-49160 is an uncontrolled resource-consumption vulnerability in the Windows HTTP protocol stack, HTTP.sys, during HTTP/2 request processing. Crafted HTTP/2 requests can cause excessive resource consumption by the HTTP server. The issue is publicly disclosed and is also referred to as HTTP/2 Bomb.

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Analyst brief

Impact, mitigation & remediation

What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

An unauthenticated remote attacker can exhaust resources on an affected HTTP.sys server and cause a denial of service. Confidentiality and integrity are not affected; availability impact is high.

Mitigation

If you can’t patch tonight, do this now.

After installing the applicable updates, configure the HTTP.sys MaxHeadersCount setting to limit the number of headers accepted in HTTP/2 and HTTP/3 requests. Limit exposure of HTTP.sys-backed services to untrusted networks where operationally feasible and monitor for anomalous or resource-intensive HTTP/2 and HTTP/3 traffic.

Remediation

Patch, then assume compromise.

Install the June 2026 Windows security updates provided by Microsoft for CVE-2026-49160. The updates enable protections for the vulnerability and introduce the MaxHeadersCount configuration setting.

Public exploits

Exploits

2 exploits validated by Mallory's analysis.

View more in app →

CVE-2026-49160-CVE-2026-47291-HTTP.sysSmall PoC repository with two files: a README describing claimed HTTP.sys issues (CVE-2026-49160 and CVE-2026-47291) and one Python exploit/probe script, http2_bomb.py. The Python script is the main artifact. It uses Python's ssl/socket libraries plus the hyper-h2 library to establish a TLS connection, require ALPN negotiation of HTTP/2 ('h2'), initiate an HTTP/2 session, and send a single GET request containing the 4 required pseudo-headers plus a user-controlled number of additional regular headers (default 20, named x-fooooooo-XXXX). It then reads and prints HTTP/2 events such as response headers, data, stream end, stream reset, or connection termination. The exploit capability is therefore a network/web-layer malformed-or-stress request generator aimed at exercising vulnerable HTTP/2 header handling in HTTP.sys, potentially for denial-of-service testing or vulnerability triggering. There is no shellcode, command execution, persistence, or follow-on payload. The README also includes a separate illustrative Python snippet that slowly sends a very large number of HTTP/1.1 headers to hello.lab over TLS and claims this can increment an internal counter toward overflow for CVE-2026-47291, but that snippet is documentation only and not present as a runnable repository file. Overall, this is a proof-of-concept network exploit repository focused on triggering or probing HTTP.sys request-header parsing behavior over HTTPS/HTTP2 rather than achieving post-exploitation control.dhmosfunk · Disclosed Jun 15, 2026 · python · markdown · network · webPoC CVE-2026-49160-HTTP.sysThis repository is a small proof-of-concept for CVE-2026-49160 targeting Microsoft HTTP.sys. It contains only two files: a minimal README identifying the issue as an HTTP.sys denial-of-service PoC, and a single Python script, http2_bomb.py, which is the operational entry point. The script uses Python's socket and ssl modules plus the hyper-h2 library to create a TLS connection, require ALPN negotiation of HTTP/2 ('h2'), and send one crafted HTTP/2 GET request with a configurable number of extra headers. The exploit logic is straightforward: connect to a user-specified host and port, optionally disable certificate validation for lab use, build the HTTP/2 pseudo-headers and many synthetic x-fooooooo-* headers, transmit them on a single stream, then monitor the target's behavior. It prints response headers if any are returned and also detects stream resets, HTTP/2 connection termination, timeouts, or abrupt TLS closure. There is no shellcode, command execution, persistence, or post-exploitation capability; the purpose is to trigger or validate a denial-of-service condition over the network against an HTTP/2-enabled HTTPS endpoint backed by HTTP.sys. The repository is not part of a larger exploit framework and appears to be a focused standalone PoC.dhmosfunk · Disclosed Jun 15, 2026 · python · markdown · network · webPoC

Exposure surface

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

Microsoft CorporationWindowsoperating_system

Microsoft CorporationWindows 10 1607operating_system

Microsoft CorporationWindows 10 1809operating_system

Microsoft CorporationWindows 10 21h2operating_system

Microsoft CorporationWindows 10 22h2operating_system

Microsoft CorporationWindows 11 23h2operating_system

Microsoft CorporationWindows 11 24h2operating_system

Microsoft CorporationWindows 11 25h2operating_system

Microsoft CorporationWindows 11 26h1operating_system

Microsoft CorporationWindows Server 2016operating_system

Microsoft CorporationWindows Server 2019operating_system

Microsoft CorporationWindows Server 2022operating_system

Microsoft CorporationWindows Server 2025operating_system

External references

References

MITRE CVEcve.org · CVE-2026-49160 NVDnvd.nist.gov/vuln/detail/CVE-2026-49160 MITRE CWE · CWE-400Uncontrolled Resource Consumption Vendor Advisorymsrc.microsoft.com/update-guide/vulnerability/CVE-2026-49160

Activity feed

Recent activity

39 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

View more in app →

hisolutions researchNews · Jul 8, 2026Der Patch-Tsunami von 2026 | HiSolutions ResearchA zero-day vulnerability in Microsoft's HTTP/2 and HTTP/3 HPACK compression handling that can trigger a compression bomb and excessive resource consumption.Read more ↗secpod blogNews · Jun 30, 2026Microsoft June 2026 Patch Tuesday Fixes 206 Flaws | SecPodA publicly disclosed, remote unauthenticated denial-of-service vulnerability in Windows HTTP.sys caused by uncontrolled resource consumption during HTTP/2 processing.Read more ↗csirt skNews · Jun 16, 2026Júnový Microsoft Patch Tuesday opravil šesť zero-day zraniteľností, jedna je aktívne zneužívaná | CSIRT.SKHigh-severity zero-day denial-of-service vulnerability in HTTP.sys caused by how the service processes incoming HTTP/2 requests, allowing remote unauthenticated attackers to exhaust system resources and cause service unavailability.Read more ↗expel blogNews · Jun 11, 2026Patch Tuesday: June 2026 (Expel’s version) | ExpelA zero-day denial-of-service vulnerability in Windows HTTP.sys that can crash vulnerable servers via a crafted HTTP/2 request.Read more ↗

+20 more in the timeline. Sign up to see them

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, and which detections to deploy tonight.

Start Free Trial Open in App ↗

Exposure mappingQuery your assets running an affected version, and investigate the blast radius.

Threat actor evidenceEvery report linking this CVE to a named adversary.

Associated malwareMalware families linked to this CVE, with evidence and IOCs.

Detection signaturesYARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mappingCross-references every affected SKU, including bundled OEM variants.

Social activity13Community discussion across Reddit, Mastodon, and other social sources.