CVE-2026-49160: HTTP/2 Resource Exhaustion DoS in Windows 10 & 11

Technical summary

CVE-2026-49160 is an uncontrolled resource consumption vulnerability (CWE-400) in Windows HTTP/2 implementation. The flaw allows an unauthenticated remote attacker to exhaust memory, CPU, or connection resources by sending malformed or high-volume HTTP/2 frames, causing targeted services to become unavailable. The vulnerability requires no user interaction and is exploitable over the network by any actor with network access to an affected system running HTTP/2-enabled services. The CVSS 3.1 score of 7.5 (HIGH severity) reflects high availability impact with low attack complexity.

Business impact

Affected organizations face potential service disruptions when HTTP/2-enabled applications or services on Windows infrastructure are targeted. This includes web servers, reverse proxies, API gateways, and other networked services leveraging HTTP/2. Organizations operating customer-facing or mission-critical systems on affected Windows versions risk extended downtime, degraded user experience, and operational disruption until mitigation is applied. The broad product footprint (Windows 10, 11, Server 2016–2025) suggests wide exposure across diverse enterprise environments.

Affected systems

The vulnerability affects Windows 10 (builds 1607, 1809, 21H2, 22H2), Windows 11 (builds 23H2, 24H2, 25H2, 26H1), Windows Server 2016, 2019, 2022, and 2025. Any system running one of these versions and hosting or proxying HTTP/2 traffic is potentially vulnerable. Systems limited to HTTP/1.1 or with HTTP/2 explicitly disabled are not affected. Organizations should audit their infrastructure to identify which systems handle HTTP/2 and prioritize patching accordingly.

Exploitability

Exploitation requires only network access and no authentication or special privileges. An attacker can craft HTTP/2 requests from outside the network perimeter to trigger resource exhaustion. The attack is straightforward to execute and does not depend on user interaction or timing-sensitive conditions, making it a practical threat. However, exploitation is visible in network traffic and resource logs, potentially enabling detection if monitoring is in place. No evidence of active exploitation in the wild has been reported as of the vulnerability's publication date (KEV status: not listed).

Remediation

Organizations must apply security updates from Microsoft addressing this vulnerability across affected platforms. Patching should prioritize systems that expose HTTP/2 services to untrusted networks or handle critical workloads. Where immediate patching is not feasible, temporary mitigations include disabling HTTP/2 support (reverting to HTTP/1.1), rate-limiting HTTP/2 connections at perimeter firewalls, and restricting network access to HTTP/2 services. Verify patch applicability against the vendor advisory before deployment.

Patch guidance

Microsoft has released security updates for the affected Windows versions. Organizations should obtain patches through Windows Update, Microsoft Update, or the Microsoft Security Update Guide. Prioritize patching Windows Server systems handling production HTTP/2 workloads, followed by Windows 11 and Windows 10 systems in similar roles. Test patches in a controlled environment before broad deployment to ensure compatibility with critical applications. Verify patch completion by confirming updated KB article numbers and re-scanning systems with vulnerability assessment tools.

Detection guidance

Monitor for indicators of HTTP/2 resource exhaustion attacks through network traffic analysis and endpoint logging. Indicators include: sudden spikes in HTTP/2 connection counts, excessive memory or CPU usage by HTTP/2 services, a high volume of HTTP/2 frames from single sources, and service restart logs corresponding to resource saturation. Deploy network intrusion detection rules that flag malformed HTTP/2 frames or unusual connection patterns. Endpoint Detection and Response (EDR) tools should alert on abnormal resource consumption by network services. Log aggregation from affected services can surface suspicious patterns before impact occurs.

Why prioritize this

Although not yet exploited in the wild (not on KEV), this vulnerability warrants near-term priority due to its HIGH severity, low attack complexity, and broad product footprint. The ease of exploitation, combined with potential service disruption to production environments, justifies rapid patching cycles. Organizations hosting public-facing HTTP/2 services should treat this as more urgent than less exposed systems. The prevalence of Windows in enterprise infrastructure means the aggregate risk is substantial.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects a high-impact denial-of-service vulnerability with minimal attack barriers. Network accessibility (AV:N), low attack complexity (AC:L), and absence of privilege or user interaction requirements (PR:N, UI:N) result in high exploitability. The impact is limited to availability (A:H) with no confidentiality or integrity compromise, which prevents a critical rating. The broad affected product range and prevalence of HTTP/2 in modern infrastructure elevate operational risk beyond the base score.

Frequently asked questions