CVE-2026-49160

What it actually does

This is a network-reachable denial-of-service vulnerability caused by uncontrolled resource consumption in HTTP/2 handling on affected Microsoft Windows versions. An unauthenticated remote attacker can send HTTP/2 traffic that causes excessive CPU, memory, connection, stream, or kernel/network-stack resource usage, degrading or exhausting availability of services that accept HTTP/2 connections. The CVSS vector indicates no authentication, user interaction, or special attack conditions are required, and the primary impact is complete or severe loss of availability rather than confidentiality or integrity compromise.

Why it matters to the business

Successful exploitation can make Windows-hosted services slow, unstable, or unavailable, including web applications, APIs, reverse proxies, or services relying on Windows HTTP components. For internet-facing systems, this can cause customer-facing outages, failed transactions, degraded service-level objectives, incident response costs, and potential cascading failures in dependent applications. The EPSS score is high enough to warrant priority even though it is not currently listed in CISA KEV and no ransomware use is reported.

How an attack unfolds

An attacker identifies a Windows system exposing a service that negotiates HTTP/2 over the network, commonly over TLS with ALPN h2 or cleartext HTTP/2 where enabled. The attacker opens one or more connections and sends HTTP/2 traffic crafted to trigger disproportionate server-side resource allocation or cleanup work. Because the flaw is unauthenticated and low complexity, the attacker does not need valid credentials or prior access. Repeating the traffic across connections or from distributed sources can consume server resources until legitimate requests time out, worker processes become saturated, services recycle, or the host becomes unavailable. Exploitation is aimed at availability disruption and does not inherently provide code execution or data access.

How to fix it

Apply the Microsoft security update that addresses CVE-2026-49160 for all affected Windows releases, including Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025. Where immediate patching is not possible, reduce exposure by disabling HTTP/2 on affected Windows services if operationally acceptable, placing vulnerable services behind a patched reverse proxy or load balancer with HTTP/2 request-rate and stream limits, restricting internet exposure, enforcing connection and request throttling, and using DDoS protection for public endpoints. Validate that compensating controls limit concurrent HTTP/2 streams, connection churn, frame abuse, and request rates without affecting legitimate clients.

How to confirm the fix worked

Confirm the installed Windows cumulative update level includes Microsoft’s fix for this vulnerability. Inventory systems that expose HTTP/2 by testing endpoints for ALPN h2 negotiation and reviewing IIS, HTTP.sys, reverse proxy, and application gateway configurations. After patching or applying mitigations, verify that services remain stable under controlled HTTP/2 load testing and that connection, stream, CPU, and memory usage return to baseline after test traffic stops. Confirm that HTTP/2 is disabled where intended or that front-end proxies enforce limits before traffic reaches vulnerable Windows hosts.

Typical attack path

1. Scan for Windows-hosted web or API services that support HTTP/2.
2. Confirm HTTP/2 negotiation using TLS ALPN h2 or other HTTP/2-capable endpoints.
3. Open one or more HTTP/2 sessions to the target service.
4. Send malformed, excessive, or resource-intensive HTTP/2 frames, streams, or request patterns that trigger uncontrolled resource consumption.
5. Sustain or distribute the traffic to keep CPU, memory, connection tables, or service workers exhausted.
6. Observe service degradation, request failures, connection resets, application pool recycling, or host unresponsiveness.

How to detect it

Look for evidence of abnormal HTTP/2 traffic before or during service degradation. Useful sources include IIS access logs, HTTPERR logs, Windows System and Application event logs, IIS/WAS event logs, load balancer logs, reverse proxy logs, WAF logs, firewall or NetFlow telemetry, packet captures, and endpoint performance telemetry. Hunt for sudden increases in HTTP/2 negotiated connections, concurrent streams, stream resets, connection resets, request timeouts, 5xx responses, 503 responses, application pool recycling, high CPU in web worker processes, nonpaged pool or memory pressure, and many short-lived connections from the same source or distributed sources. IIS logs may not record malformed or prematurely terminated HTTP/2 traffic, so correlate with HTTPERR, proxy, firewall, and packet-level telemetry. Because there are no public exploit-specific strings in the provided data, treat the indicators as behavioral and correlate them with availability impact.

• ALPN=h2
• h2
• HTTP/2
• %SystemDrive%\inetpub\logs\LogFiles\HTTPERR\httperr*.log
• %SystemDrive%\inetpub\logs\LogFiles\W3SVC*\*.log
• C:\Windows\System32\LogFiles\HTTPERR\httperr*.log
• 503
• Connection_Abandoned_By_ReqQueue
• Timer_ConnectionIdle
• Timer_MinBytesPerSecond
• w3wp.exe
• svchost.exe
• Microsoft-Windows-WAS
• Microsoft-Windows-IIS-W3SVC-WP
• application pool has been disabled
• A process serving application pool
• The worker process failed to respond to a ping
• connection reset
• stream reset
• RST_STREAM
• GOAWAY

What your security team should do

• Prioritize patching internet-facing Windows servers that host IIS, APIs, reverse proxies, or other HTTP/2-enabled services.
• Identify all affected Windows 10, Windows 11, and Windows Server assets that expose HTTP/2, with highest urgency for externally reachable systems.
• If patching is delayed, temporarily disable HTTP/2 or terminate HTTP/2 at a patched proxy or load balancer with strict rate, stream, and connection limits.
• Enable or tune DDoS protections, web application firewall rate controls, and load balancer limits for HTTP/2 traffic.
• Monitor for spikes in HTTP/2 connections, streams, resets, request failures, CPU, memory, application pool recycles, and HTTPERR entries.
• Create incident runbooks for isolating abusive source IPs, disabling HTTP/2, scaling capacity, and failing over critical services during an active denial-of-service event.
• Track Microsoft security guidance and update compliance because no fixed version list was provided in the input.