CVE-2013-1305: HTTP.sys in Microsoft Windows 8, Windows Server 2012, and Windows RT allows remote attackers to cause a den...

Security readout for executives and security teams

CVE-2013-1305 is a remote denial-of-service issue in Microsoft HTTP.sys. A specially crafted HTTP header can make affected Windows systems enter an infinite loop, disrupting services rather than exposing data or enabling code execution based on the provided sources. Exposure is most likely on affected Windows 8, Windows Server 2012, or Windows RT systems where HTTP.sys handles HTTP traffic. The bundle does not identify specific applications, roles, or configurations required beyond the affected component and operating systems. Treat this as a service availability risk for legacy affected Windows systems. It is not described as data theft or remote code execution, but internet-facing HTTP services could be disrupted if unremediated. Mitigation focus: Review Microsoft MS13-039 for vendor guidance and applicable security updates.; Inventory Windows 8, Windows Server 2012, and Windows RT systems.; Prioritize internet-facing systems that process HTTP traffic through HTTP.sys..

Prepared

Jun 14, 2026, 22:07 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.