CVE-2021-31166: HTTP Protocol Stack Remote Code Execution Vulnerability

Overview

Severity
Critical (CVSS 9.8)
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Category
Remote Code Execution
Exploit Status
Not Exploited
Exploitation Likelihood
More Likely
Patch Tuesday
2021-May
Released
2021-05-11
EPSS Score
99.87% (percentile: 100.0%)
CISA KEV
Listed — due 2022-04-27

FAQ

How could an attacker exploit this vulnerability? In most situations, an unauthenticated attacker could send a specially crafted packet to a targeted server utilizing the HTTP Protocol Stack (http.sys) to process packets. Is this wormable? Yes. Microsoft recommends prioritizing the patching of affected servers.

Known Exploits (11)

  • Microsoft HTTP Protocol Stack Remote Code Execution Vulnerability — added 2025-09-15T13:50:23Z
  • Microsoft HTTP Protocol Stack Remote Code Execution Vulnerability — added 2024-10-22T19:10:50Z
  • Microsoft HTTP Protocol Stack Remote Code Execution Vulnerability — added 2023-12-21T00:23:38Z
  • Microsoft HTTP Protocol Stack Remote Code Execution Vulnerability — added 2023-12-21T00:23:36Z
  • Microsoft HTTP Protocol Stack Remote Code Execution Vulnerability — added 2023-12-21T00:23:28Z
  • Microsoft HTTP Protocol Stack Remote Code Execution Vulnerability — added 2023-07-05T03:53:10Z
  • Microsoft HTTP Protocol Stack Remote Code Execution Vulnerability — added 2022-11-22T09:10:36Z
  • Microsoft HTTP Protocol Stack Remote Code Execution Vulnerability — added 2021-05-21T10:38:41+08:00
  • Microsoft HTTP Protocol Stack Remote Code Execution Vulnerability — added 2021-05-20T05:00:38+08:00
  • Microsoft HTTP Protocol Stack Remote Code Execution Vulnerability — added 2021-05-18T20:34:58+08:00
  • Microsoft HTTP Protocol Stack Remote Code Execution Vulnerability — added 2021-05-16T16:15:56Z

Detection & Weaponization (3 sources)

Maturity: Detection

  • Metasploit modules: Windows IIS HTTP Protocol Stack DOS
  • YARA rules: exploit_cve_2021_31166.yar, SIGNATURE_BASE_EXPL_CVE_2021_31166_Accept_Encoding_May21_1
  • GitHub PoC: 11 repositories

Affected Products (7)

Windows

  • Windows 10 Version 2004 for 32-bit Systems
  • Windows 10 Version 2004 for ARM64-based Systems
  • Windows 10 Version 2004 for x64-based Systems
  • Windows Server, version 2004 (Server Core installation)
  • Windows 10 Version 20H2 for 32-bit Systems
  • Windows 10 Version 20H2 for ARM64-based Systems
  • Windows Server, version 20H2 (Server Core Installation)

Security Updates (1)

Acknowledgments

Microsoft Platform Security & Vulnerability Research

Revision History

  • 2021-05-11: Information published.