CVE-2021-31166

What it actually does

CVE-2021-31166 is a pre-authentication remote code execution vulnerability in the Windows HTTP Protocol Stack, commonly exposed through HTTP.sys-backed services such as IIS or other Windows services that register HTTP listeners. The flaw is a use-after-free condition in HTTP.sys request parsing, associated with crafted HTTP headers/trailers. Because HTTP.sys runs in kernel mode, successful exploitation can allow attacker-controlled code execution with high privileges, potentially at the SYSTEM/kernel level. Failed exploitation may crash the host, producing a denial of service. The vulnerability is network exploitable, requires no credentials or user interaction, has low attack complexity, and affects Windows 10 2004/20H2 and Windows Server 2004/20H2 systems that have not received the May 2021 or later cumulative security updates.

Why it matters to the business

An exposed and unpatched Windows HTTP listener can be compromised remotely by an unauthenticated attacker, creating risk of full server takeover, service outage, lateral movement, data theft, and deployment of additional malware. The risk is high because exploitation has been observed in the wild, the EPSS score is extremely high, and the issue is listed in CISA KEV with a remediation deadline that has long passed. Internet-facing Windows web services or management endpoints using HTTP.sys should be treated as urgent remediation targets.

How an attack unfolds

An attacker first identifies a Windows host exposing an HTTP.sys-backed service over HTTP or HTTPS. They then send a specially crafted HTTP request that abuses HTTP trailer/header parsing, commonly involving chunked transfer semantics and malformed encoding-related fields. HTTP.sys processes the request in kernel mode before application-layer code can safely reject it. The malformed request triggers a use-after-free condition, allowing memory corruption. A reliable exploit can redirect execution and run attacker-controlled code with very high privileges; less reliable attempts may cause a blue screen or service disruption. After code execution, an attacker would typically establish persistence, run discovery commands, dump credentials, deploy tooling, and move laterally to other systems.

How to fix it

Install the Microsoft cumulative security update from May 2021 or any later cumulative update for all affected Windows 10 2004/20H2 and Windows Server 2004/20H2 systems. Because no fixed package versions were provided in the input, use Microsoft Update, WSUS, Configuration Manager, or the Microsoft Update Catalog to ensure the relevant operating system build is fully patched beyond the May 2021 security baseline. If immediate patching is not possible, reduce exposure by removing internet access to HTTP.sys-backed services, placing vulnerable services behind filtering reverse proxies or WAFs, disabling unnecessary HTTP listeners, and applying Microsoft’s documented mitigation to disable HTTP trailer support where applicable by setting HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters\EnableTrailerSupport to 0 and restarting the HTTP service or host as required. Mitigation should be considered temporary; patching is the definitive fix.

How to confirm the fix worked

Confirm the operating system has the May 2021 or later cumulative security update installed and that the OS build level is no longer vulnerable. Validate via Windows Update history, installed hotfix inventory, vulnerability scanner results, or Microsoft Update compliance tooling. Enumerate active HTTP.sys listeners with commands such as netsh http show servicestate and netsh http show urlacl, then verify that exposed listeners are either patched, unnecessary services are removed, or access is restricted. If a temporary mitigation was used, confirm HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters\EnableTrailerSupport is set to 0 where applicable. Re-scan externally and internally for vulnerable Windows HTTP services and confirm vulnerability scanners no longer report CVE-2021-31166 exposure.

Typical attack path

1. Scan for Windows HTTP.sys-backed services exposed on HTTP/HTTPS ports such as 80, 443, 8080, 5985, or application-specific listener ports.
2. Confirm the target appears to be a vulnerable Windows 10 2004/20H2 or Windows Server 2004/20H2 system without the May 2021 or later cumulative update.
3. Send a crafted HTTP request using malformed header/trailer content that triggers the HTTP.sys use-after-free condition.
4. Achieve remote code execution in the HTTP.sys kernel execution context, or crash the host if exploitation is unreliable.
5. Execute post-exploitation commands, stage malware, create persistence, or obtain credentials.
6. Use the compromised host to access internal services, pivot laterally, or disrupt business operations.

How to detect it

To determine whether exploitation already occurred, review network, web, endpoint, and Windows telemetry around exposed HTTP.sys services. IIS access logs may not record all relevant headers by default, so prioritize reverse proxy logs, WAF logs, packet captures, EDR network telemetry, and Microsoft-Windows-HttpService/HTTPERR logs where available. Look for malformed HTTP/1.1 requests using chunked transfer encoding with trailer headers, especially trailer fields referencing Accept-Encoding or unusual encoding values. Review Windows System logs for unexpected bug checks, Kernel-Power restarts, WER crash reports, or HTTP service failures that coincide with inbound HTTP requests. In EDR, investigate suspicious SYSTEM-level execution, unexpected child processes from web-service contexts, new services, scheduled tasks, dropped binaries, credential access tools, or outbound connections following suspicious HTTP traffic. Because public exploitation attempts often crash vulnerable hosts, unexplained blue screens on exposed Windows Server 2004/20H2 or Windows 10 2004/20H2 systems should be treated as possible failed exploitation until ruled out.

• Trailer: Accept-Encoding
• Transfer-Encoding: chunked
• 0\r\nAccept-Encoding:
• HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters\EnableTrailerSupport
• netsh http show servicestate
• Microsoft-Windows-HttpService
• HTTPERR
• Event ID 1001
• Event ID 41

What your security team should do

• Prioritize immediate patch verification for all Windows 10 2004/20H2 and Windows Server 2004/20H2 systems, especially internet-facing web, API, proxy, and management endpoints.
• Treat any unpatched internet-facing HTTP.sys listener as a critical exposure because the vulnerability is in CISA KEV, has active exploitation, and has a very high EPSS likelihood.
• Restrict inbound access to HTTP.sys-backed services until patching is confirmed, allowing only trusted networks or fronting services with a patched reverse proxy where business constraints permit.
• Hunt for prior exploitation using IIS logs, HTTP.sys/HTTPERR logs, Windows System event logs, EDR telemetry, crash reports, and network captures for malformed chunked requests and trailer-based Accept-Encoding activity.
• Investigate unexpected blue screens, kernel crashes, HTTP service instability, or suspicious SYSTEM-level process activity on affected systems around the time of suspicious HTTP traffic.
• Inventory HTTP.sys consumers using netsh http show servicestate and validate that non-IIS services using HTTP.sys are also included in remediation scope.
• Retire or upgrade end-of-service Windows feature releases rather than relying on compensating controls for legacy exposure.