Uncontrolled resource consumption in the HTTP/2 implementation of Windows HTTP.sys allows an unauthenticated attacker to exhaust system resources and render the host unresponsive. The vulnerability manifests as a denial of service when the attacker sends crafted HTTP/2 traffic to the affected system. The weakness corresponds to CWE-400, where unvalidated input leads to resource exhaustion.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H1; Windows Server 2016, Windows Server 2016 (Server Core), Windows Server 2019, Windows Server 2019 (Server Core), Windows Server 2022, Windows Server 2025, and Windows Server 2025 (Server Core).

The CVSS score of 7.5 indicates high severity. EPSS is not available, and the vulnerability is not listed in CISA KEV, so current scarcity of publicly known exploitation reduces immediate risk. Nonetheless, the likely attack vector is through an unauthenticated network connection, making the vulnerability remotely exploitable. Monitoring for malicious traffic patterns and applying the vendor‑supplied patch is essential.