The following workarounds might be helpful in your situation. In all cases, Microsoft strongly recommends that you install the updates for this vulnerability as soon as possible even if you plan to leave either of these workarounds in place:

**Disable the HTTP/2 protocol on your web server by using the Registry Editor**

**Note** Using Registry Editor incorrectly can cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk. For information about how to edit the registry, view the "Changing Keys and Values" Help topic in Registry Editor (Regedit.exe) or view the "Add and Delete Information in the Registry" and "Edit Registry Data" Help topics in Regedt32.exe.

1.  Click **Start**, click **Run**, type **Regedit** in the **Open** box, and then click **OK**.
2.  Locate and then click the following registry subkey: HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters
3.  Set **DWORD** type values **EnableHttp2TIs** and **EnableHttp2Cleartext** to one of the following:
    *   Set to **0** to disable HTTP/2
    *   Set to **1** to enable HTTP/2
4.  Exit Registry Editor.
5.  Restart the computer.

**Include a protocols setting for each Kestral endpoint to limit your application to HTTP1.1**

For .NET and Kestral, servers without HTTP/2 enabled are not affected. To limit your application to HTTP1.1 via config, edit your appsettings.json to include a protocols setting for each endpoint:

    
    "Kestrel": {
       "Endpoints": { 
         "http": { 
           // your existing config 
           "Protocols": "Http1" 
         }, 
         "https": { 
            // your existing config 
           "Protocols": "Http1" 
         } 
       } 
     } 
    	
    	```

Tag

#HTTP/2