KB5068787: fixes an issue in the HTTP.sys request parser

November 11, 2025—KB5068787 (OS Build 20348.4405)

Improvements
This security update contains fixes and quality improvements from KB5066782 (released October 14, 2025) and KB5070884 (released October 23, 2025). The following summary outlines key issues addressed by this update. Also, included are available new features. The bold text within the brackets indicates the item or area of the change.

• [Security] Fixed: This update addresses an issue that affects Windows Server domain controllers using Microsoft Defender for Endpoint. After domain controller promotion, changes to registry permissions disrupted cloud-based communication.
• [Networking] Fixed: This update fixes an issue in the HTTP.sys request parser, a Windows component that reads and processes HTTP requests. The parser allowed a single line break within HTTP/1.1 chunk extensions, where the RFC 9112 standard requires a carriage return and line feed (CRLF) sequence to terminate each chunk. This can cause a parsing discrepancy when front end proxies are a part of the setup.

To turn on strict parsing, use the following registry key:

Registry Key: [HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Http\\Parameters]

Registry value: "HttpAllowLenientChunkExtParsing"=dword:00000000

Data to be set: 0