http.sys security

The http.sys security tag covers discussions about vulnerabilities and hardening of the Windows HTTP protocol stack, a kernel-mode component that handles HTTP requests for IIS and applications using the Windows HTTP Server API. Recent content focuses on CVE-2026-47291, a remote code execution vulnerability disclosed by Microsoft as a critical Patch Tuesday item. The tag emphasizes that http.sys security is distinct from web server bugs because http.sys operates deep in the Windows networking path, making it a priority for server administrators. Topics include patch management, risk assessment, and the unique attack surface of http.sys.