What is the CVSS score of CVE-2026-49160?

CVE-2026-49160 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 1.2%.

Which versions of Microsoft HTTP/2 are affected by CVE-2026-49160?

Microsoft's HTTP/2 implementation contains a remote denial-of-service vulnerability (CVE-2026-49160, CVSS 7.5) allowing unauthenticated attackers to exhaust server resources and disrupt service…. A patch is available.

Is there a public PoC exploit available for CVE-2026-49160?

Yes, a public proof-of-concept exploit is available for CVE-2026-49160. Prioritise patching immediately. EPSS: 1.2%.

How to fix or mitigate CVE-2026-49160?

Within 24 hours: Inventory all Microsoft servers with HTTP/2 enabled; enable detailed monitoring and alerting for abnormal resource consumption and connection patterns. Within 7 days: Deploy compensating controls including HTTP/2 connection rate limiting, network-level request throttling, and evaluate reverting to HTTP/1.1 where operationally feasible. Within 30 days: Check Microsoft's MSRC advisories weekly for patch availability; establish change management procedures for rapid deployment once vendor releases a fix.

Microsoft HTTP/2 CVE-2026-49160

EUVD-2026-35588 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-06-09 secure@microsoft.com

GHSA-g6wq-v77v-v58c

Denial Of Service Windows 10 1607 Windows 10 1809 Windows 10 21h2 Windows 10 22h2 Windows 11 23h2 Windows 11 24h2 Windows 11 25h2 Windows 11 26h1 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025

7.5

CVSS 3.1 · Vendor: microsoft

Temporal: 6.5

Severity by source

Vendor (microsoft) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CIRCL (temporal)

6.5 MEDIUM

cvss

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 17:44 vuln.today

DescriptionCVE.org

Uncontrolled resource consumption in HTTP/2 allows an unauthorized attacker to deny service over a network.

Articles & Coverage 1

POC CVE-2026-47291 & CVE-2026-49160: HTTP.sys Integer Overflow DoS and Remote Code Execution PoC Jun 17, 2026

AnalysisAI

Remote denial-of-service in Microsoft's HTTP/2 implementation allows unauthenticated network attackers to exhaust server resources and disrupt service availability. The flaw (CWE-400, uncontrolled resource consumption) was reported by Microsoft's MSRC and carries a CVSS 7.5 score driven entirely by availability impact, with no public exploit identified at time of analysis.

Technical ContextAI

The vulnerability resides in Microsoft's implementation of the HTTP/2 protocol, a binary, multiplexed transport layer used by IIS, HTTP.sys, and dependent Windows services. HTTP/2's stream multiplexing, header compression (HPACK), and flow-control windowing create multiple state-tracking surfaces where a server must allocate memory, CPU, or connection state per stream or frame. CWE-400 (Uncontrolled Resource Consumption) indicates the implementation lacks adequate ceilings or rate limits on one of these structures - historically similar to the HTTP/2 'Rapid Reset' (CVE-2023-44487) and stream-flood family of issues - letting an attacker drive resource use disproportionate to their effort. The provided CPE data does not enumerate specific Windows or IIS versions; vendor advisory must be consulted for the exact affected component.

RemediationAI

Apply the Microsoft security update referenced in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49160 once the exact KB for your Windows/IIS build is identified; patch status is available per vendor advisory but a specific fix version is not included in the provided input. As compensating controls until patched, place affected endpoints behind an HTTP/2-aware reverse proxy or WAF (e.g., Azure Front Door, Cloudflare, or an updated nginx/Envoy) that enforces per-connection stream limits and frame-rate caps, or temporarily disable HTTP/2 on HTTP.sys via the registry 'EnableHttp2Tls' / 'EnableHttp2Cleartext' DWORDs set to 0 - note this forces clients back to HTTP/1.1 with measurable latency and throughput regressions for modern browsers and gRPC workloads. Additionally, apply network-layer rate limiting and connection caps at the load balancer to blunt floods, accepting that legitimate high-concurrency clients may be throttled.