First published: Thu Jun 14 2018(Updated: )
A denial of service vulnerability exists in the HTTP 2.0 protocol stack (HTTP.sys) when HTTP.sys improperly parses specially crafted HTTP 2.0 requests, aka "HTTP.sys Denial of Service Vulnerability." This affects Windows Server 2016, Windows 10, Windows 10 Servers.
Credit: secure@microsoft.com
Affected Software | Affected Version | How to fix |
---|---|---|
Microsoft Windows 10 | ||
Microsoft Windows 10 | =1607 | |
Microsoft Windows 10 | =1703 | |
Microsoft Windows 10 | =1709 | |
Microsoft Windows 10 | =1803 | |
Microsoft Windows Server 1803 | ||
Microsoft Windows Server 2016 | ||
Microsoft Windows Server 2016 | =1709 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2018-8226 is classified as a denial of service vulnerability that can impact availability.
To fix CVE-2018-8226, ensure that your Windows Server or Windows 10 systems are updated with the latest security patches provided by Microsoft.
CVE-2018-8226 affects Windows Server 2016 and various versions of Windows 10, including versions 1607, 1703, 1709, and 1803.
Exploiting CVE-2018-8226 can lead to a denial of service condition, rendering the affected system unresponsive.
Currently, the best workaround for CVE-2018-8226 is to limit HTTP/2 traffic or implement network filters until a security update can be applied.