IIS and CVE-2026-49975

Hello Rene_Gross​ and IIS Team,

I've been trying to replicate the behavior described in that article in my own local lab environment using Windows Server instances, and I wanted to share what I've observed under the hood so far, as it might help your SOC team.

Here is how my lab environments reacted to the payload:

Windows Server 2019 Observations

When sending the specific high-load traffic to a Windows Server 2019 instance, the operating system consistently encounters a critical system error resulting in an immediate restart (Stop Error).

• Debugging the event indicates that the failure originates directly within the core HTTP network driver due to an unhandled exception related to a null pointer.
• Result: In this specific version, the high-volume traffic induces an immediate system crash.

Windows Server 2022 Observations

When replicating the exact same test conditions on Windows Server 2022, the behavior is completely different. In comparison to Server 2019, this version does not experience an unhandled exception or a system crash dump.

1. Result: Instead, resources (CPU and memory) instantly saturate at maximum capacity, causing the guest operating system to become entirely unresponsive. Because the instance runs under a virtualized environment, the hypervisor eventually triggers a hard reset due to integration heartbeat loss, preventing any local error logs from being written before the reboot.

Mitigation Findings

Since I haven't seen any official updates regarding this specific behavior, the only effective workaround I found to keep the services stable during testing was to transition the traffic to HTTP/1.1.

I hope these lab findings give your team a clearer picture of how the OS might react depending on the version you are running!

I'm open and more than happy to share further details from my lab if needed, such as the captured dump files or how I emulated the large volume of requests to generate the stress test.