{"id":"CVE-2021-31166","published":"2021-05-11T19:15:09Z","modified":"2026-06-17T03:51:21Z","title":"Microsoft HTTP Protocol Stack Remote Code Execution Vulnerability","vendor":"Microsoft","product":"HTTP Protocol Stack","tier":"core","eol":null,"description":{"text":"HTTP Protocol Stack Remote Code Execution Vulnerability","provenance":"source","from":"NVD"},"summary":{"text":"The Microsoft HTTP Protocol Stack contains a remote code execution flaw classified as a use-after-free memory corruption bug. An attacker who can reach the affected service over the network can trigger it without authentication, user interaction, or any special configuration, and can gain code execution with a high impact on confidentiality, integrity, and availability.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:09:32Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99867,"percentile":0.99963,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2022-04-06","dueDate":"2022-04-27","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-31166","provenance":"source"},"vulncheckKev":{"dateAdded":"2022-03-24","exploitedFirstSeen":"2022-03-24","ransomware":true,"evidence":[{"url":"https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/2022-unit42-ransomware-threat-report-final.pdf","date":"2022-03-24"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-04-06"},{"url":"https://static.tenable.com/marketing/whitepapers/Whitepaper-Ransomware_Ecosystem.pdf","date":"2022-06-22"}],"evidenceTotal":3,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-416","name":"Use After Free"}],"references":[{"url":"http://packetstormsecurity.com/files/162722/Microsoft-HTTP-Protocol-Stack-Remote-Code-Execution.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-31166","tags":["Patch","Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/162722/Microsoft-HTTP-Protocol-Stack-Remote-Code-Execution.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-31166","tags":["Patch","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-31166","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution","mappingType":"exploitation_technique","evidence":[],"comment":"This memory corruption vulnerability is exploited by a remote, unauthenticated attacker via crafted HTTP packets to a server that uses http.sys to process packets. Adversaries may leverage this vulnerability to execute malicious code on the OS kernel. This vulnerability has a proof of concept validating that it can be wormable. However, exploitations in the wild linking to this type of impact have not been published. \n\nThe North Korean state-backed hacker group known as the Lazarus Group has been attributed to leveraging this vulnerability in their attacks to gain initial access to Windows IIS servers. Once initial access is gained, they have exploited the vulnerable system to perform data theft, disrupt services, propagate malware, or conduct espionage or surveillance. \n\n**team review - AttackerKB links Command and Scripting to this vulnerability, but I have not found any threat reports linking this impact to an actual attack. The only \"in the wild\" report I found was by SecureBlink linking it to the Lazarus Group to gain initial access. Unsure what primary impact we can link to here. ","confidence":"medium","confidenceNote":"CTID KEV capability group \"code execution\" is generic"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution","mappingType":"primary_impact","evidence":[],"comment":"This memory corruption vulnerability is exploited by a remote, unauthenticated attacker via crafted HTTP packets to a server that uses http.sys to process packets. Adversaries may leverage this vulnerability to execute malicious code on the OS kernel. This vulnerability has a proof of concept validating that it can be wormable. However, exploitations in the wild linking to this type of impact have not been published. \n\nThe North Korean state-backed hacker group known as the Lazarus Group has been attributed to leveraging this vulnerability in their attacks to gain initial access to Windows IIS servers. Once initial access is gained, they have exploited the vulnerable system to perform data theft, disrupt services, propagate malware, or conduct espionage or surveillance. \n\n**team review - AttackerKB links Command and Scripting to this vulnerability, but I have not found any threat reports linking this impact to an actual attack. The only \"in the wild\" report I found was by SecureBlink linking it to the Lazarus Group to gain initial access. Unsure what primary impact we can link to here. ","confidence":"medium","confidenceNote":"CTID KEV capability group \"code execution\" is generic"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2021-18079","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-18079","exploited":true,"exploitedSince":"2022-04-06","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":11,"skipped":1,"earliest":"2021-05-16","earliestUrl":"https://github.com/0vercl0k/CVE-2021-31166","repos":[{"name":"0vercl0k/CVE-2021-31166","url":"https://github.com/0vercl0k/CVE-2021-31166","stars":823,"created":"2021-05-16"},{"name":"ZZ-SOCMAP/CVE-2021-31166","url":"https://github.com/ZZ-SOCMAP/CVE-2021-31166","stars":19,"created":"2021-09-27"},{"name":"corelight/CVE-2021-31166","url":"https://github.com/corelight/CVE-2021-31166","stars":12,"created":"2021-05-17"},{"name":"zha0gongz1/CVE-2021-31166","url":"https://github.com/zha0gongz1/CVE-2021-31166","stars":8,"created":"2021-05-17"},{"name":"0xmaximus/Home-Demolisher","url":"https://github.com/0xmaximus/Home-Demolisher","stars":8,"created":"2022-11-22"}]},"metasploit":[{"name":"Windows IIS HTTP Protocol Stack DOS","module":"auxiliary/dos/windows/http/http_sys_accept_encoding_dos_cve_2021_31166","type":"auxiliary","disclosureDate":"2021-05-11","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/windows/http/http_sys_accept_encoding_dos_cve_2021_31166.rb"}],"first":{"date":"2021-05-11","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/windows/http/http_sys_accept_encoding_dos_cve_2021_31166.rb"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/162722/Microsoft-HTTP-Protocol-Stack-Remote-Code-Execution.html"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"source"},{"stage":"primary","techniques":["T1059"],"provenance":"source"}],"timeline":[{"date":"2021-05-11","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-31166","provenance":"source"},{"date":"2021-05-11","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2021-05-16","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/windows/http/http_sys_accept_encoding_dos_cve_2021_31166.rb","provenance":"source"},{"date":"2022-03-24","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/2022-unit42-ransomware-threat-report-final.pdf","provenance":"source"},{"date":"2022-04-06","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-04-06","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-18079","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"Metasploit","daysToKev":330},"priority":{"score":79.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1680 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.99,"detail":"percentile 0.9996"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD exploit link; 11 PoC-in-GitHub repos; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}