Control the maximum number of HTTP/2 and HTTP/3 request headers in Windows clients and servers

Introduction

HTTP headers are name-value pairs included in HTTP requests and responses. In Windows environments, client components such as WinHTTP and WinINet, and server components such as IIS, use headers to exchange metadata and control request and response behavior.

Windows supports HTTP headers across HTTP/1.1, HTTP/2, and HTTP/3. Although these protocol versions transmit headers differently, Windows applies standard HTTP header semantics. Administrators can configure header-processing limits, including a registry setting that controls the maximum number of headers allowed in HTTP/2 and HTTP/3 requests for the requests to be accepted by the HTTP server.

Take action

After you install a Windows update released on or after June 9, 2026, you can use the MaxHeadersCount registry setting to limit the number of headers that can be included in HTTP/2 and HTTP/3 requests for the requests to be accepted by the HTTP server.

This setting limits the maximum number of headers that can be included in an HTTP/2 or HTTP/3 request. Limiting HTTP headers can help protect systems and servers from excessive memory use, high CPU consumption, and denial-of-service attacks. Because HTTP/2 (HPACK) or HTTP/3 (QPACK) header compression is used and more complex protocol processing, enforcing a header limit such as MaxHeadersCount can help maintain performance and reliability. Please note that depending on another existing setting MaxRequestBytes, HTTP.sys may further increase this header limit that is actually enforced. 

Configure the registry value MaxHeadersCount as follows:

For the change to take effect, restart the computer after you create or update the MaxHeadersCount registry value.