STIGQter: STIG Summary: Microsoft IIS 10.0 Server Security Technical Implementation Guide Version: 3 Release: 7 Benchmark Date: 01 Apr 2026:

The Request Smuggling filter must be enabled.

DISA Rule

SV-268325r1025163_rule

Vulnerability Number

V-268325

Group Title

SRG-APP-000141-WSR-000015

Rule Version

IIST-SV-000220

Severity

CAT II

CCI(s)

• CCI-000381 - Configure the system to provide only organization-defined mission essential capabilities.

Weight

10

Fix Recommendation

Navigate to "HKLM\System\CurrentControlSet\Services\HTTP\Parameters".
Create REG_DWORD "DisableRequestSmuggling” and set it to "1".

Note: This can be performed multiple ways; this is an example.

Check Contents

Open Registry Editor.
Navigate to "HKLM\System\CurrentControlSet\Services\HTTP\Parameters"
Verify "DisableRequestSmuggling” is set to "1".

If REG_DWORD DisableRequestSmuggling is not set to 1, this is a finding.

Vulnerability Number

V-268325

Documentable

False

Rule Version

IIST-SV-000220

Severity Override Guidance

Open Registry Editor.
Navigate to "HKLM\System\CurrentControlSet\Services\HTTP\Parameters"
Verify "DisableRequestSmuggling” is set to "1".

If REG_DWORD DisableRequestSmuggling is not set to 1, this is a finding.

Check Content Reference

M

Target Key

4052