Cybersecurity Researcher Uncovers Critical HTTP Service Vulnerabilities in Windows

6 Jan 2026

windowshttp_servicescybersecurityvulnerabilitiesremote_code_executiondenial_of_servicecvercedosbranchcacheocspremote_desktop_gatewaymemory_corruptionlogical_flaws

🎬 Researcher Kosho, affiliated with Cyber Cool and the University of Science and Technology, presents an analysis of vulnerabilities in Windows HTTP services, exploiting logical flaws and Remote Code Execution (RCE)-type vulnerabilities. Native HTTP services, accessible without authentication, rely on APIs such as HttpCreateServerSession and HttpReceiveHttpRequest, with synchronous or asynchronous processing flows. Several Denial of Service (DoS) vulnerabilities are detailed, including CVE-2024-43512 (infinite loop due to an unupdated buffer) and CVE-2025-27471 (error in handling asynchronous requests). A flaw in the BranchCache service (exploiting non-paged pool exhaustion) and CVE-2024-38067 (undecremented reference in OCSP) illustrate persistent DoS attacks. RCE vulnerabilities are also discussed, such as CVE-2024-43639 (memory overflow in KPS Proxy) and a flaw in Remote Desktop Gateway (use-after-free via a dangling pointer). The conclusions emphasize that logical DoS attacks remain critical, even without memory corruption, and that HTTP services are prone to errors in managing posted data.