Sign in with Microsoft
Sign in or create an account.
Select a different account.
You have multiple accounts
Choose the account you want to sign in with.


HTTP/2 Settings frames are used by endpoints to exchange defined settings parameters with each other. The HTTP/2 protocol doesn’t define any practical limit on the number of settings parameters included in a single settings frame (max allowed is 2796202) and there is no limit on the number of times such settings frames are exchanged.

A malicious client using HTTP/2 can exploit this fact to make an HTTP/2 server system temporarily unstable, by increasing the CPU usage to 100% before the connections are terminated by the Internet Information Services (IIS).


To address this issue, Microsoft has provided an ability to define limits on the number of HTTP/2 settings parameters allowed over a connection. These limits are not preset by Microsoft and must be defined by system administrator after reviewing the HTTP/2 protocol and their environment requirements.

Below are the two registry entries added to set the limits:


Path: Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HTTP\Parameters

Name: Http2MaxSettingsPerFrame


Data: Supported min value 7 and max 2796202. Out of range values trimmed to corresponding min/max end value.


Path: Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HTTP\Parameters

Name: Http2MaxSettingsPerMinute


Data: Supported min value 7. Smaller value trimmed to the min value.


Note: A machine reboot, or service restart is required to read the configured registry values, when they are added first time or changed.

With the limits set,

  • If a single Setting frame contains more settings parameters than "Http2MaxSettingsPerFrame" value, then that connection is immediately killed.

  • If the number of settings parameters contained in multiple Settings frames received within a minute crosses "Http2MaxSettingsPerMinute" value, then connection is killed.

When appropriately set, above two limits together help to terminate the malicious connection violating those limits and form a threshold for legitimate connections

Need more help?

Want more options?

Explore subscription benefits, browse training courses, learn how to secure your device, and more.

Communities help you ask and answer questions, give feedback, and hear from experts with rich knowledge.

Was this information helpful?

What affected your experience?
By pressing submit, your feedback will be used to improve Microsoft products and services. Your IT admin will be able to collect this data. Privacy Statement.

Thank you for your feedback!