CVE-2018-0956 — Microsoft Windows 10 vulnerability

4 documents4 sources
Severity
7.5HIGHNVD
EPSS
26.4%
top 3.67%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Microsoft Windows 10Microsoft Windows 10 ServersMicrosoft Windows Server 2016
Timeline
PublishedApr 12
Latest updateMay 13

Description

A denial of service vulnerability exists in the HTTP 2.0 protocol stack (HTTP.sys) when HTTP.sys improperly parses specially crafted HTTP 2.0 requests, aka "HTTP.sys Denial of Service Vulnerability." This affects Windows Server 2016, Windows 10, Windows 10 Servers.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages5 packages

▶CVEListV5microsoft/windows_10_serversversion 1709 (Server Core Installation)
▶CVEListV5microsoft/windows_server_2016(Server Core installation)
▶CVEListV5microsoft/windows_1010 versions+9
▶NVDmicrosoft/windows_104 versions+3

Patches

Patch: portal.msrc.microsoft.com ↗Patch: portal.msrc.microsoft.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-g2h3-89xx-5947: A denial of service vulnerability exists in the HTTP 2↗2022-05-13
▶
CVEList
CVE-2018-0956: A denial of service vulnerability exists in the HTTP 2↗2018-04-12
▶

📋Vendor Advisories

1
Microsoft
HTTP/2 Server Denial of Service Vulnerability↗2018-04-10
▶
CVE-2018-0956 — Microsoft Windows 10 vulnerability | cvebase