Microsoft flags IIS flaw that could lead to 100% CPU usage spikes when exploited

The DoS vulnerability involves sending malicious HTTP/2 connections that can slow down or freeze users' systems

Photo of a Microsoft building with clouds in view

Microsoft has released a security alert outlining a vulnerability with its web server technology that, if exploited, could block or slow down the entire system.

The denial of service (DoS) issue, first detected by F5 Networks' Gal Goldshtein, affects HTTP/2 connections to the Microsoft's Internet Information Services (IIS) platform, built for use with the Windows NT operating system.

Malicious HTTP/2 requests can be sent to a Windows Server running IIS, which would lead to the systems CPU usage to spike to 100% until the malicious connections are killed by IIS, the firm outlined in its advisory published yesterday.

Advertisement - Article continues below

"The HTTP/2 specification allows clients to specify any number of SETTINGS frames with any number of SETTINGS parameters," the security alert said.

"In some situations, excessive settings can cause services to become unstable and may result in a temporary CPU usage spike until the connection timeout is reached and the connection is closed."

Microsoft has not identified any mitigations or workaround as of yet, but are advising users to install a February 'non-security update', and review a 'knowledge base article', which at the time of writing links to a 404 page-not-found error message.

The firm has also attempted to mitigate the vulnerability by giving users the functionality to define thresholds on settings parameters included in an HTTP/2 request.

Advertisement - Article continues below

After patching their systems with recently-released cumulative updates, Microsoft added, system administrators can customise the HTTP/2 settings threshold and prevent the bug from slowing down or blocking their IIS web services.

Advertisement - Article continues below

Microsoft has had to contend with a number of high profile vulnerabilities recently, especially during the rollout of major upgrades to its Windows 10 operating system. This has led to the firm already commencing early beta testing for a major update due in 2020, much earlier than the process would normally begin.

Featured Resources

Top 5 challenges of migrating applications to the cloud

Explore how VMware Cloud on AWS helps to address common cloud migration challenges

Download now

3 reasons why now is the time to rethink your network

Changing requirements call for new solutions

Download now

All-flash buyer’s guide

Tips for evaluating Solid-State Arrays

Download now

Enabling enterprise machine and deep learning with intelligent storage

The power of AI can only be realised through efficient and performant delivery of data

Download now


Business operations

Amazon and Microsoft join NHS project battling pandemic

27 Mar 2020
Microsoft Windows

Microsoft puts Windows development on lockdown

25 Mar 2020
backup software

Windows File History and Backup review: Useful but limited

25 Mar 2020
web browser

Microsoft halts Edge browser updates in light of coronavirus pandemic

24 Mar 2020

Most Popular

Server & storage

HPE warns of 'critical' bug that destroys SSDs after 40,000 hours

26 Mar 2020

These are the companies offering free software during the coronavirus crisis

25 Mar 2020
video conferencing

Zoom beams iOS user data to Facebook for targeted ads

27 Mar 2020
high-performance computing (HPC)

IBM dedicates supercomputing power to coronavirus research

24 Mar 2020