CVE-2026-33096: HTTP.sys Denial of Service Vulnerability

CVE-2026-33096 is a denial of service vulnerability in HTTP.sys, rated Important by Microsoft, with a CVSS 3.1 base score of 7.5 (High). An attacker can exploit it remotely over the network, without any privileges and without user interaction. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. The EPSS model estimates a 1.25% probability of exploitation activity in the next 30 days, higher than 69% of all scored vulnerabilities. Microsoft released the fix on 14 April 2026 in the April 2026 Patch Tuesday, delivered through 6 security updates (KB5083768, KB5082142, KB5082063, KB5083769 and more). It affects 13 products in 1 product family (Windows).

Key facts

CVE ID

CVE-2026-33096

Severity

High CVSS 7.5

Microsoft severity

Important

Impact

Denial of Service

Exploited in the wild

No

Publicly disclosed

No

Exploitation likelihood

Less Likely

Weakness

CWE-125

EPSS

1.25% (percentile 69%)

CISA KEV

Not listed

Released

14 April 2026

Last updated

14 April 2026

Patch Tuesday

April 2026 Patch Tuesday

Product families

Windows

CVSS score and vector

Microsoft scores CVE-2026-33096 at 7.5 (temporal 6.5) using CVSS 3.1. Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C

Description

Out-of-bounds read in Windows HTTP.sys allows an unauthorized attacker to deny service over a network.

Mitigations and workarounds

Mitigation refers to a setting, common configuration, or general best-practice, existing in a default state, that could reduce the severity of exploitation of a vulnerability.

The following mitigating factors might help in your situation:

Caution Follow these steps carefully. Serious problems might occur if you modify the registry incorrectly.

To disable HTTP/3, remove the following registry values from the specified key:

• Open Registry Editor (regedit.exe).
• Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HTTP\Parameters.
• Back up the key: select Parameters, then select File > Export, and save the .reg file to a secure location.
• If present, delete the EnableHttp3 value.
• If present, delete the EnableAltSvc value.
• Restart the device after making these changes.

After the restart, all http.sys-based server applications on that device will no longer serve HTTP/3 clients.

Note: If either value is not present, no change is required for that value.

Restore: To undo this change, double-click the exported .reg file (or in Registry Editor, select File > Import) to restore the previous settings.

After you install the security update, you no longer need this mitigation.

Affected products (13)

Windows

Security updates (6)

• KB5083768 (Security Update)
• KB5082142 (Security Update)
• KB5082063 (Security Update)
• KB5083769 (Security Update)
• KB5082052 (Security Update)
• KB5082060 (Security Update)

NIST NVD data

NVD status

Analyzed

NVD CVSS

7.5 (HIGH)

NVD weakness

CWE-125

Published to NVD

14 April 2026

NVD last modified

17 April 2026

Affected configurations (CPE)

References

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33096 (Mitigation, Vendor Advisory)

Acknowledgments

• WARP & MORSE teams at Microsoft
• Milad Nasr (Anthropic) and Calif.io with Claude
• WARP & MORSE teams at Microsoft
• Milad Nasr (Anthropic) and Calif.io with Claude

Revision history

Related vulnerabilities

Other HTTP.sys vulnerabilities

• CVE-2026-70247: HTTP.sys Remote Code Execution Vulnerability (High, CVSS 7.8, October 2026)
• CVE-2026-83714: HTTP.sys Information Disclosure Vulnerability (Medium, CVSS 5.5, October 2026)
• CVE-2026-83705: HTTP.sys Information Disclosure Vulnerability (Medium, CVSS 5.5, October 2026)
• CVE-2026-70208: HTTP.sys Information Disclosure Vulnerability (Medium, CVSS 5.5, October 2026)
• CVE-2026-49787: HTTP.sys Denial of Service Vulnerability (High, CVSS 7.5, July 2026)
• CVE-2026-50420: HTTP.sys Information Disclosure Vulnerability (Medium, CVSS 6.2, July 2026)
• CVE-2026-47291: HTTP.sys Remote Code Execution Vulnerability (Critical, CVSS 9.8, June 2026)
• CVE-2026-49160: HTTP.sys Denial of Service Vulnerability (High, CVSS 7.5, June 2026)
• CVE-2025-53805: HTTP.sys Denial of Service Vulnerability (High, CVSS 7.5, September 2025)
• CVE-2025-27473: HTTP.sys Denial of Service Vulnerability (High, CVSS 7.5, April 2025)
• CVE-2024-26219: HTTP.sys Denial of Service Vulnerability (High, CVSS 7.5, April 2024)
• CVE-2023-35298: HTTP.sys Denial of Service Vulnerability (High, CVSS 7.5, July 2023)

More from the April 2026 Patch Tuesday

• CVE-2026-32202: Windows Shell Spoofing Vulnerability (Medium, CVSS 4.3, exploited)
• CVE-2026-32225: Windows Shell Security Feature Bypass Vulnerability (High, CVSS 8.8)
• CVE-2026-32162: Windows COM Elevation of Privilege Vulnerability (High, CVSS 8.4)
• CVE-2026-33826: Windows Active Directory Remote Code Execution Vulnerability (High, CVSS 8)
• CVE-2026-27909: Windows Search Service Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2026-27914: Microsoft Management Console Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2026-32152: Desktop Window Manager Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2026-32154: Desktop Window Manager Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2026-27913: Windows BitLocker Security Feature Bypass Vulnerability (High, CVSS 7.7)
• CVE-2026-26151: Remote Desktop Spoofing Vulnerability (High, CVSS 7.1)
• CVE-2026-27908: Windows TDI Translation Driver (tdx.sys) Elevation of Privilege Vulnerability (High, CVSS 7)
• CVE-2026-27921: Windows TDI Translation Driver (tdx.sys) Elevation of Privilege Vulnerability (High, CVSS 7)

All vulnerabilities of this release: April 2026 Patch Tuesday · April 2026 briefing

Sources

• Microsoft Security Update Guide: CVE-2026-33096
• NIST NVD: CVE-2026-33096
• CVE.org record: CVE-2026-33096