CVE-2024-26219

Deeper analysis

CVE-2024-26219 is a denial-of-service vulnerability in HTTP.sys, the kernel-mode HTTP protocol stack driver used by Microsoft Windows for handling HTTP requests. It is tracked under CWE-476 as a NULL pointer dereference and carries a CVSS 3.1 base score of 7.5, reflecting network attack vectors that require no authentication, privileges, or user interaction while producing a high impact on availability.

An unauthenticated remote attacker can send specially crafted HTTP traffic to an affected system and trigger the flaw, resulting in a crash or sustained unavailability of the HTTP service and any dependent applications. The attack requires only network reachability and can be performed without prior access or credentials.

Microsoft has published technical details and remediation guidance for the issue through its Security Response Center at the listed references. The associated EPSS score has remained flat at 0.1498 with no material increase since disclosure.