CVE-2023-21687

MediumCVSS 5.5

Published: 14/02/2023(UTC)Updated: 19/08/2026(UTC)Translated: 19/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.47%

39th percentile - higher than 39% of all known CVEs

Summary

An information disclosure vulnerability in the HTTP.sys component of Windows. Technical details are not provided in the description.

Risk Assessment

The vulnerability may allow an attacker to gain unauthorized access to information processed by HTTP.sys, potentially compromising data confidentiality.

Recommendation

Apply security updates provided by Microsoft for affected Windows systems that include a fix for this vulnerability.

Other vulnerabilities in HTTP.sys

See all

CVE-2016-0150High
HTTP.sys in Microsoft Windows 10 Gold and 1511 allows remote attackers to cause a denial of service (system hang) via crafted HTTP 2.0 requests.
CVE-2023-35298High
A vulnerability in HTTP.sys allows attackers to trigger a Denial of Service (DoS) state by sending specially crafted HTTP requests. This can lead to server downtime.

Original NVD description (English source)

HTTP.sys Information Disclosure Vulnerability