CVE-2015-1635

CRITICAL KEV NUCLEI

MS15-034 HTTP Protocol Stack Request Handling Denial-of-Service

Title source: metasploit
STIX 2.1

Exploitation Summary

CVE-2015-1635 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added February 10, 2022. EIP tracks 20 public exploits from researchers including laurent gaffie, rhcp011235, technion, including a Metasploit module auxiliary/dos/http/ms15_034_ulonglongadd. A Nuclei detection template is also available.

AI-analyzed exploit summary This exploit triggers a denial-of-service (DoS) condition in Microsoft IIS by sending a malformed HTTP Range header, causing the server to crash. It requires the presence of 'iisstart.htm' and sends two HTTP requests to exploit CVE-2015-1635.

Description

HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted HTTP requests, aka "HTTP.sys Remote Code Execution Vulnerability."

Exploits (20)

exploitdb WORKING POC
by laurent gaffie · pythondoswindows
https://www.exploit-db.com/exploits/36776

This exploit triggers a denial-of-service (DoS) condition in Microsoft IIS by sending a malformed HTTP Range header, causing the server to crash. It requires the presence of 'iisstart.htm' and sends two HTTP requests to exploit CVE-2015-1635.

Classification
Working Poc 90%
Attack Type
Dos
Complexity
Trivial
Reliability
Reliable
Target: Microsoft IIS 6.0-10.0
No auth needed
Prerequisites: Target server must have 'iisstart.htm' accessible · Network access to TCP port 80
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb SCANNER
by rhcp011235 · cdoswindows
https://www.exploit-db.com/exploits/36773

This code is a scanner for CVE-2025-1635 (MS15-034), which checks if a target IIS server is vulnerable to the HTTP.sys Range header DoS vulnerability. It sends a malformed Range header and checks the response to determine vulnerability status.

Classification
Scanner 90%
Attack Type
Dos
Complexity
Trivial
Reliability
Reliable
Target: Microsoft IIS with HTTP.sys (versions prior to the MS15-034 patch)
No auth needed
Prerequisites: Network access to the target IIS server
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec SCANNER 10 stars
by technion · poc
https://github.com/technion/erlvulnscan

This repository contains a web-based concurrent scanner for CVE-2015-1635, which is a vulnerability in Microsoft Windows HTTP.sys. The scanner is built using Erlang and includes a frontend developed with TypeScript and Webpack.

Classification
Scanner 90%
Attack Type
Dos
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Windows HTTP.sys
No auth needed
Prerequisites: Network access to target systems running vulnerable HTTP.sys
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec SCANNER 9 stars
by aedoo · dos
https://github.com/aedoo/CVE-2015-1635-POC

This PoC checks for the presence of CVE-2015-1635 (MS15-034) by sending a crafted HTTP request with an invalid Range header to trigger a denial-of-service condition in Microsoft IIS HTTP.sys. It does not execute arbitrary code but confirms vulnerability existence.

Classification
Scanner 90%
Attack Type
Dos
Complexity
Trivial
Reliability
Reliable
Target: Microsoft IIS HTTP.sys (versions 6.0-10.0)
No auth needed
Prerequisites: Network access to target IIS server on port 80
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec SCANNER 2 stars
by h3x0v3rl0rd · poc
https://github.com/h3x0v3rl0rd/CVE-2015-1635-POC

This repository contains a scanner for CVE-2015-1635, which checks if a target IIS server is vulnerable to the HTTP.sys Remote Code Execution vulnerability (MS15-034). It sends a crafted HTTP request with an invalid Range header to detect the vulnerability.

Classification
Scanner 90%
Attack Type
Dos
Complexity
Trivial
Reliability
Reliable
Target: Microsoft IIS with HTTP.sys (versions prior to the MS15-034 patch)
No auth needed
Prerequisites: Network access to the target IIS server
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec SCANNER 2 stars
by Zx7ffa4512-Python · dos
https://github.com/Zx7ffa4512-Python/Project-CVE-2015-1635

This repository contains a Python script that checks for the presence of CVE-2015-1635 (MS15-034), a remote code execution vulnerability in HTTP.sys. The script sends a crafted HTTP request to determine if the target IIS server is vulnerable or patched.

Classification
Scanner 90%
Attack Type
Dos
Complexity
Trivial
Reliability
Reliable
Target: Microsoft IIS with HTTP.sys (versions prior to the patch for MS15-034)
No auth needed
Prerequisites: Network access to the target IIS server
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec SCANNER 1 stars
by Cappricio-Securities · poc
https://github.com/Cappricio-Securities/CVE-2015-1635

This repository contains a Python-based scanner for detecting CVE-2015-1635, a Windows HTTP.sys remote code execution vulnerability. The tool checks for the presence of the vulnerability by sending crafted HTTP requests and analyzing responses for specific error messages.

Classification
Scanner 90%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: Microsoft Windows HTTP.sys (HTTP Protocol Stack)
No auth needed
Prerequisites: Network access to the target system · HTTP.sys service exposed
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 1 stars
by w01ke · dos
https://github.com/w01ke/CVE-2015-1635-POC

This PoC checks for CVE-2015-1635 (MS15-034), an integer overflow vulnerability in Microsoft HTTP.sys. It sends a crafted HTTP request with an oversized Range header to trigger the vulnerability and checks the response to determine if the target is vulnerable.

Classification
Working Poc 90%
Attack Type
Dos
Complexity
Trivial
Reliability
Reliable
Target: Microsoft HTTP.sys (IIS 6.0 and later)
No auth needed
Prerequisites: Network access to the target IIS server
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec SCANNER 1 stars
by bongbongco · dos
https://github.com/bongbongco/MS15-034

This PoC checks for the presence of CVE-2015-1635 (MS15-034) by sending a malformed HTTP Range header to an IIS server and analyzing the response to determine if the server is vulnerable or patched.

Classification
Scanner 90%
Attack Type
Dos
Complexity
Trivial
Reliability
Reliable
Target: Microsoft IIS (versions affected by CVE-2015-1635)
No auth needed
Prerequisites: Network access to the target IIS server on port 80
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec SCANNER
by moeinmiadi · dos
https://github.com/moeinmiadi/CVE-2015-1635_PoC

This PoC checks for the presence of CVE-2015-1635 (HTTP.sys Remote Code Execution) by sending a malformed Range header and checking for a 416 response. It does not exploit the vulnerability but detects its presence.

Classification
Scanner 90%
Attack Type
Dos
Complexity
Trivial
Reliability
Reliable
Target: Microsoft HTTP.sys (IIS)
No auth needed
Prerequisites: Network access to the target server
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec SCANNER
by SkinAir · dos
https://github.com/SkinAir/ms15-034-Scan

This repository contains a Python-based scanner for detecting CVE-2015-1635 (MS15-034), a vulnerability in Microsoft IIS. The script checks for the presence of the vulnerability by sending crafted HTTP requests and analyzing responses.

Classification
Scanner 95%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: Microsoft IIS (versions affected by CVE-2015-1635)
No auth needed
Prerequisites: List of target URLs in a text file
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC
by h3x0v3rl0rd · poc
https://github.com/h3x0v3rl0rd/CVE-2015-1635

This repository contains a Python-based toolkit for exploiting CVE-2015-1635, a vulnerability in HTTP.sys that allows for denial-of-service (DoS) attacks via a malformed Range header. The tool includes both a vulnerability scanner and a DoS attack module.

Classification
Working Poc 95%
Attack Type
Dos
Complexity
Trivial
Reliability
Reliable
Target: Microsoft Windows HTTP.sys (IIS)
No auth needed
Prerequisites: Python 3.6+ · aiohttp library · target URLs or IP addresses
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec SCANNER
by u0pattern · dos
https://github.com/u0pattern/Remove-IIS-RIIS

This PoC checks for CVE-2015-1635, a DoS vulnerability in Microsoft IIS due to improper handling of HTTP Range headers. It sends a crafted HTTP request with an excessively large Range header to trigger the vulnerability.

Classification
Scanner 90%
Attack Type
Dos
Complexity
Trivial
Reliability
Reliable
Target: Microsoft IIS 6.0-8.0
No auth needed
Prerequisites: Network access to target IIS server
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec SCANNER
by wiredaem0n · dos
https://github.com/wiredaem0n/chk-ms15-034

This repository contains a Python script to check for CVE-2015-1635 (MS15-034), a vulnerability in HTTP.sys that allows remote code execution via a crafted HTTP request. The script sends a malformed Range header to determine vulnerability status and includes an optional DoS attack payload.

Classification
Scanner 90%
Attack Type
Dos
Complexity
Trivial
Reliability
Reliable
Target: Microsoft HTTP.sys (IIS)
No auth needed
Prerequisites: Network access to the target server
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec SCANNER
by hedgecore · poc
https://github.com/hedgecore/HTTPsys

This repository contains a PHP-based web scanner for detecting CVE-2015-1635 (MS15-034), a vulnerability in HTTP.sys that allows remote code execution. It sends a crafted HTTP request with a malformed Range header to check if the target server is vulnerable.

Classification
Scanner 95%
Attack Type
Dos
Complexity
Trivial
Reliability
Reliable
Target: Microsoft HTTP.sys (IIS)
No auth needed
Prerequisites: Network access to the target server
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit WORKING POC
by Bill Finlayson, sinn3r · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/http/ms15_034_ulonglongadd.rb

This Metasploit module exploits CVE-2015-1635, a vulnerability in Microsoft HTTP.sys (MS15-034), by sending a malformed Range header to trigger a denial-of-service (DoS) condition. It includes both detection and exploitation logic.

Classification
Working Poc 100%
Attack Type
Dos
Complexity
Trivial
Reliability
Reliable
Target: Microsoft HTTP.sys (Windows 7, Windows Server 2008 R2, and later)
No auth needed
Prerequisites: Network access to the target HTTP service
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit WORKING POC
rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/ms15_034_http_sys_memory_dump.rb

This Metasploit module exploits CVE-2015-1635 (MS15-034) to dump memory contents from vulnerable Windows systems (8.1, Server 2012, 2012R2) by sending a crafted Range header in an HTTP request, leveraging an information disclosure vulnerability in HTTP.SYS.

Classification
Working Poc 100%
Attack Type
Info Leak
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Windows 8.1, Windows Server 2012, Windows Server 2012 R2 (HTTP.SYS)
No auth needed
Prerequisites: Network access to the target system · Target must be running a vulnerable version of Windows with HTTP.SYS exposed
devstral-2 · analyzed Feb 16, 2026 Full analysis →
patchapalooza WORKING POC
by n3rdh4x0r · dos
https://github.com/n3rdh4x0r/CVE-2015-1635

This repository contains a functional exploit for CVE-2015-1635 (MS15-034), which is a HTTP.sys vulnerability in Microsoft Windows. The exploit sends a crafted HTTP request with a malformed Range header to trigger a denial-of-service (DoS) condition. The tool includes both vulnerability scanning and DoS attack capabilities.

Classification
Working Poc 95%
Attack Type
Dos
Complexity
Trivial
Reliability
Reliable
Target: Microsoft Windows HTTP.sys (HTTP Protocol Stack)
No auth needed
Prerequisites: network access to target server · Python 3.6+ with aiohttp and user_agent libraries
devstral-2 · analyzed Feb 23, 2026 Full analysis →
patchapalooza SCANNER
by n3rdh4x0r · dos
https://github.com/n3rdh4x0r/CVE-2015-1635-POC

The repository contains a C program that checks for the presence of CVE-2015-1635 (HTTP.sys vulnerability) by sending crafted HTTP requests to detect if the target IIS server is vulnerable or patched. It does not exploit the vulnerability but scans for its presence.

Classification
Scanner 95%
Attack Type
Dos
Complexity
Trivial
Reliability
Reliable
Target: Microsoft IIS with HTTP.sys (prior to MS15-034 patch)
No auth needed
Prerequisites: network access to target IIS server
devstral-2 · analyzed Feb 23, 2026 Full analysis →
patchapalooza SCANNER
by yaogodv · poc
https://gitee.com/yaogodv/Project-CVE-2015-1635

This repository contains a Python script that scans for the presence of CVE-2015-1635 (MS15-034), an HTTP.sys remote code execution vulnerability in Microsoft IIS. The script sends a crafted HTTP request with a malformed Range header to detect if the target system is vulnerable or patched.

Classification
Scanner 95%
Attack Type
Dos
Complexity
Trivial
Reliability
Reliable
Target: Microsoft IIS (HTTP.sys)
No auth needed
Prerequisites: Network access to the target IIS server
devstral-2 · analyzed Feb 23, 2026 Full analysis →

Nuclei Templates (1)

Microsoft Windows 'HTTP.sys' - Remote Code Execution
CRITICALVERIFIEDby Phillipo
Shodan: "Microsoft-IIS" "2015" || "microsoft-iis" "2015" || cpe:"cpe:2.3:o:microsoft:windows_7"

References (8)

Core 8
Core References
Patch, Vendor Advisory vendor-advisory x_refsource_ms
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-034
Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/36773/
Broken Link vdb-entry x_refsource_osvdb
http://www.osvdb.org/120629
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1032109
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/74013
Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/36776/

Scores

CVSS v3 9.8
EPSS 0.9431
EPSS Percentile 100.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation active
Automatable yes
Technical Impact total

Details

CISA KEV 2022-02-10
VulnCheck KEV 2021-04-12
InTheWild.io 2022-02-10
ENISA EUVD EUVD-2015-1765
CWE
CWE-94
Status published
Products (6)
microsoft/windows_7
microsoft/windows_8
microsoft/windows_8.1
microsoft/windows_server_2008 r2 sp1 (2 CPE variants)
microsoft/windows_server_2012
microsoft/windows_server_2012 r2
Published Apr 14, 2015
KEV Added Feb 10, 2022
Tracked Since Feb 18, 2026