CVE-2021-31166

Microsoft HTTP Protocol Stack Remote Code Execution Vulnerability

Published May 11, 2021 · updated Jun 16, 2026 · microsoft windows 10 2004

Microsoft HTTP Protocol Stack contains a vulnerability in http.sys that allows for remote code execution.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Detection, updates, and resolution for this record.

May 11, 2021 · Catalog
Detected
Microsoft HTTP Protocol Stack contains a vulnerability in http.sys that allows for remote code execution.
Apr 6, 2022 · CISA KEV
Known exploited
Apply updates per vendor instructions.
Apr 27, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
Microsoft HTTP Protocol Stack contains a vulnerability in http.sys that allows for remote code execution.

Apply updates per vendor instructions.

CISA due date Apr 27, 2022

CISA KEVConfirmed exploitationCVE-2021-31166
Microsoft HTTP Protocol Stack contains a vulnerability in http.sys that allows for remote code execution.
cisa.gov
CVE.orgVulnerability recordCVE-2021-31166
Official CVE identifier
cve.org
FIRST EPSSExploitation probabilityCVE-2021-31166
30-day exploitation probability 99.9%
first.org
Metasploit ModulesPublic exploit moduleauxiliary_dos/windows/http/http_sys_accept_encoding_dos_cve_2021_31166
Public module reference (normal). Module source is not copied into this catalog.
rapid7.com
NIST NVDVulnerability recordCVE-2021-31166
HTTP Protocol Stack Remote Code Execution Vulnerability
nvd.nist.gov
Packet Storm SecurityCited referencehttp://packetstormsecurity.com/files/162722/Microsoft-HTTP-Protocol-Stack-Remote-Code-Execution.html
Packet Storm link already published on the finding.
packetstormsecurity.com