CVE-2026-47291

Меры по смягчению последствий

To help protect against this vulnerability prior to installing the June 2026 security updates for your operating system, you may need to modify the MaxRequestBytes registry value used by the Windows HTTP stack if it isn't set to the default value.

Note

• Systems using the default value (16384 bytes / 16 KB) are not impacted by this vulnerability.
• Configurations that increase this value beyond safe limits may expose the system.
• The minimum safe value to avoid this vulnerability is 65534 bytes (~65 KB).
• Using Registry Editor incorrectly can cause serious problems that may require you to reinstall your operating system. Use Registry Editor at your own risk.

Configure the registry setting using Registry Editor

1. Select Start, type regedit, and open Registry Editor.

2. Navigate to the following registry key:

   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HTTP\Parameters

3. Locate the value MaxRequestBytes:

• If the value does not exist:

  • Right-click in the right pane → New → DWORD (32-bit) Value
  • Name the value: MaxRequestBytes

1. Double-click MaxRequestBytes and configure the value:

• Select Decimal

• Set one of the following values:

  • 16384 → Default (recommended; not vulnerable)
  • 65534 → Lowest value that avoids exposure while allowing larger requests

1. Select OK, and then close Registry Editor.

2. Restart the HTTP service or restart the system

   net stop http /y net start http

Configure the registry setting using PowerShell

1. Open PowerShell as Administrator.

2. Run the following command:

   $path = "HKLM:\SYSTEM\CurrentControlSet\Services\HTTP\Parameters" New-ItemProperty -Path $path -Name MaxRequestBytes -PropertyType DWORD -Value 16384 -Force
   • Replace 16384 with another value (for example, 65534) if required.

3. Restart the HTTP service:

   net stop http /y net start http

Verify the registry setting

Run the following command to confirm the configured value:

reg query HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters /v MaxRequestBytes

How to revert the change (undo the mitigation)

Restore the default value

1. Open Registry Editor.

2. Navigate to:

   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HTTP\Parameters

3. Set MaxRequestBytes to:

   16384

Or remove the registry value

• Delete the MaxRequestBytes registry entry.
• Windows will use the default behavior.

Apply the rollback

1. Double-click MaxRequestBytes and configure the value:
2. Restart the HTTP service or restart the system.

FAQ

How could an attacker exploit this vulnerability?

In most situations, an unauthenticated attacker could send a specially crafted packet to a targeted server utilizing the HTTP Protocol Stack (http.sys) to process packets.