CVE-2026-49788

What it actually does

This vulnerability is a network-reachable denial-of-service condition in the Windows HTTP/2 implementation caused by insufficient limits or throttling on resource allocation. An unauthenticated remote attacker can send crafted or excessive HTTP/2 traffic that causes the target to allocate disproportionate CPU, memory, connection, stream, or kernel HTTP stack resources, degrading or exhausting availability. The impact is availability-only: confidentiality and integrity are not directly affected, but exposed HTTP/2-capable services on affected Windows client and server versions can become slow, unresponsive, or unable to accept legitimate requests.

Why it matters to the business

Successful exploitation can interrupt Windows-hosted web services, APIs, reverse proxies, application gateways, management portals, or other HTTP/2-enabled services, causing outages for customers and internal users. Because exploitation is unauthenticated, network-based, and low-complexity, internet-facing services are the highest priority even though EPSS is currently low and the issue is not listed in CISA KEV. Organizations with broadly deployed Windows Server or IIS-based services should treat this as an operational resilience risk and patch during the next urgent maintenance window for externally reachable systems.

How an attack unfolds

An attacker first identifies a Windows-hosted service that supports HTTP/2, commonly over TLS using ALPN negotiation. The attacker then opens one or more HTTP/2 connections and sends traffic patterns that cause the server to allocate resources without sufficient limiting or throttling. Depending on the vulnerable code path, this may involve a high volume of streams, frames, requests, header activity, or connection churn. The server consumes excessive CPU, memory, HTTP.sys, IIS, or application worker resources while processing the malicious traffic. As exhaustion increases, legitimate users experience elevated latency, failed connections, HTTP 503 responses, worker process recycling, connection resets, or complete service unavailability. The attack may be repeated or distributed to sustain the outage until traffic is blocked, HTTP/2 is disabled, rate limits are applied, or the host is patched.

How to fix it

Apply the Microsoft security update or cumulative update that fixes CVE-2026-49788 for the affected Windows versions, prioritizing internet-facing Windows Server 2016, 2019, 2022, and 2025 systems and any Windows 10 or Windows 11 hosts exposing HTTP/2-capable services. If fixed package versions or KB numbers are not yet mapped in asset tooling, use Microsoft Update, WSUS, Microsoft Update Catalog, or endpoint management platforms to deploy the July 2026 or later security servicing updates applicable to each supported OS branch. Where immediate patching is not possible, reduce exposure by disabling HTTP/2 on affected Windows-hosted services where business impact is acceptable, restricting access to trusted networks, placing a patched reverse proxy or WAF/CDN in front of the service, enforcing connection and request rate limits, and blocking abusive sources at the edge. Validate that mitigations do not break applications that depend on HTTP/2 features such as multiplexing or gRPC.

How to confirm the fix worked

Confirm that each affected Windows version has the applicable Microsoft security or cumulative update installed for July 2026 or later. Validate through enterprise patch inventory, Windows Update history, Get-HotFix, DISM package inventory, or vulnerability scanning authenticated to the host. For exposed services, confirm whether HTTP/2 is still enabled and whether it is required. Use safe testing only: verify that normal HTTP/2 requests succeed, rate limits function, and abnormal connection or stream bursts are throttled without causing service instability. Re-run vulnerability scanners after patch deployment and ensure they no longer report the affected Windows build as vulnerable. Monitor resource utilization and HTTP error rates after remediation to confirm the service remains stable under expected traffic loads.

Typical attack path

1. Discover internet-facing or reachable Windows services that accept HTTPS/HTTP/2 connections.
2. Confirm HTTP/2 support through TLS ALPN negotiation or service fingerprinting.
3. Generate crafted or high-volume HTTP/2 requests, streams, or frames that trigger excessive resource allocation.
4. Sustain or parallelize the traffic to exhaust server resources such as CPU, memory, connection tables, HTTP.sys queues, or IIS worker capacity.
5. Observe service degradation, HTTP errors, connection resets, worker process failures, or full denial of service.
6. Repeat the traffic pattern or distribute it across multiple sources to prolong the outage and complicate blocking.

How to detect it

Investigate for signs of availability attacks against HTTP/2-capable Windows services around periods of latency, outages, or resource exhaustion. Review IIS access logs, HTTPERR logs, reverse proxy and load balancer logs, WAF/CDN telemetry, firewall/NetFlow data, Windows System and Application event logs, Microsoft-Windows-HttpEvent logs, and performance telemetry for CPU, memory, connection, request queue, and worker process saturation. Look for sudden bursts of HTTP/2 connections from one or more source IPs, unusually high request or stream counts per connection, repeated connection resets, abnormal TLS ALPN negotiation to h2 followed by little useful application traffic, spikes in HTTP 503/500-class responses, IIS application pool recycles, WAS/W3SVC warnings, and HTTP.sys queue or connection errors. Because the vulnerability is denial-of-service oriented, evidence may be transient and may not leave a payload artifact; prioritize correlation of traffic spikes with service degradation, process recycling, and HTTPERR/IIS errors. If named threat intelligence is absent, treat unexplained HTTP/2 resource exhaustion from untrusted networks as suspicious and preserve packet captures, edge logs, and volatile performance data where possible.

• C:\Windows\System32\LogFiles\HTTPERR\httperr*.log
• C:\inetpub\logs\LogFiles\W3SVC*\*.log
• Microsoft-Windows-HttpEvent
• Microsoft-Windows-WAS
• W3SVC
• w3wp.exe
• HTTP/2
• h2
• RST_STREAM
• GOAWAY
• 503
• QueueFull
• Connection_Dropped
• Timer_ConnectionIdle
• Application pool has been disabled
• A process serving application pool

What your security team should do

• Prioritize patching externally reachable Windows Server systems that host IIS, HTTP.sys-based applications, APIs, reverse proxies, or other HTTPS services supporting HTTP/2.
• Inventory all affected Windows 10, Windows 11, and Windows Server versions and determine which systems expose HTTP/2-capable services to untrusted networks.
• Apply the applicable Microsoft cumulative/security updates from July 2026 or later, using authenticated scanning to verify installation.
• Where patching cannot be completed quickly, disable HTTP/2 or restrict it to trusted front-end infrastructure, and apply WAF/CDN, load balancer, or firewall rate limits for HTTP/2 connections and streams.
• Increase monitoring for spikes in HTTP/2 traffic, connection resets, HTTP 503 responses, CPU or memory exhaustion, IIS worker process recycling, and HTTP.sys queue pressure.
• Prepare edge blocking procedures for abusive source IPs and consider upstream DDoS protection if exposed services are business-critical.
• Because this is not currently in CISA KEV and EPSS is low, align remaining internal-only systems to standard patch cycles after internet-facing assets are remediated.