Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Loading CVE intelligence

Loading vulnerability catalog

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

Tool Directory

CVE-2021-31166

CriticalPublished

HTTP Protocol Stack Remote Code Execution Vulnerability

Published: May 11, 2021
Updated: Oct 21, 2025
Assigning CNA: microsoft
Evidence observed: Apr 6, 2022

Primary CVSS

9.8/ 10Critical

nvd · CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS probability estimate

99.8%

High · next 30 days

Percentile: 100.0%
Model date: Sep 21, 2026

EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.

CISA Known Exploited

This CVE appears in the CISA Known Exploited Vulnerabilities catalog.

Summary

HTTP Protocol Stack Remote Code Execution Vulnerability

Sources

CVE-2021-31166Detection
Detection rules (Suricata + Zeek) for CVE-2021-31166 HTTP Protocol Stack vulnerability, providing network-level alerts on exploit attempts against Windows IIS servers.
CVE-2021-31166Exploit
CVE-2021-31166: exploitation with Powershell, Python, Ruby, NMAP and Metasploit.
CVE-2021-31166-detection-rulesDetection
Different rules to detect if CVE-2021-31166 is being exploited
CVE-2021-31166-Exploit

Responsible use

Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.

Exploit

Exploit for MS Http Protocol Stack RCE vulnerability (CVE-2021-31166)

CVE-2021-31166Exploit

simple bash script for exploit CVE-2021-31166

CVE-2021-31166PoC

PoC for CVE-2021-31166, a remote HTTP.sys use-after-free triggered remotely. Although it was defined as remote command execution, it can only cause the system to crash.

CVE-2021-31166PoC

Windows HTTP协议栈远程代码执行漏洞 CVE-2021-31166

Home-DemolisherPoC

PoC for CVE-2021-31166 and CVE-2022-21907

WIn-CVE-2021-31166PoC

Proof-of-concept for CVE-2021-31166 (http.sys RCE) with Terraform deployment on AWS, including testing scripts and a WAFv2 rule to block the exploit.

CVE-2021-31166-exploitExploit

Exploit for CVE-2021-31166 targeting HTTP Protocol Stack RCE in Windows 10 and Server versions 2004/20H2, enabling remote code execution via crafted packets.