KB5068865: Windows 11 Version 23H2 Security Update (OS Build 22631.6199) - November 2025
November 11, 2025 cumulative security update for Windows 11 version 23H2, bringing OS build to 22631.6199 with HTTP.sys parser fix and Secure Boot certificate guidance.
Summary
This is the November 11, 2025 cumulative security update for Windows 11, version 23H2, bringing the OS build to 22631.6199. Released on November 11, 2025, it is a monthly security update that also incorporates non-security improvements carried over from last month's optional preview release. Source: Microsoft Support.
Highlights
- This update addresses security issues for the Windows operating system.
Improvements and fixes
- HTTP.sys request parser fix (Networking): The update corrects a parsing issue in HTTP.sys, the Windows component responsible for reading and processing HTTP requests. Previously, the parser accepted a single line break within HTTP/1.1 chunk extensions, whereas the RFC 9112 standard requires a carriage return and line feed (CRLF) sequence to end each chunk. This discrepancy could cause problems when front-end proxies are part of the setup. To enforce strict parsing, administrators can set the following registry value to
0: keyHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Http\Parameters, value nameHttpAllowLenientChunkExtParsing(DWORD00000000). - Servicing stack update (KB5068070, build 22621.6120): A servicing stack update is bundled with this release, delivering quality improvements to the component that installs Windows updates and ensuring devices can reliably receive future updates.
- Secure Boot certificate notice: Secure Boot certificates used by most Windows devices are scheduled to begin expiring in June 2026. Microsoft has been deploying updated certificates to consumer and non-managed business devices over recent months. Devices that have not yet received the newer certificates will continue to start and operate normally, and standard Windows updates will continue to install. IT administrators should consult the Secure Boot Playbook for Windows clients and Windows Server. Device certificate status can be checked in the Windows Security app.
- Microsoft Store apps: This cumulative update does not include updates for Microsoft Store apps. Enterprise users should refer to Microsoft Store apps guidance in Configuration Manager; consumer users should use the Get Updates feature in the Microsoft Store.
Known issues
Microsoft lists no known issues for this update at the time of writing.
How to get this update
Microsoft combines the latest servicing stack update (SSU) with the latest cumulative update (LCU) into a single package, so no separate SSU installation is required beforehand.
This update is available through the following channels:
- Windows Update / Microsoft Update: Downloads and installs automatically.
- Windows Update for Business: Deploys automatically in accordance with configured policies.
- Microsoft Update Catalog: A standalone package can be downloaded directly from the catalog.
- Windows Server Update Services (WSUS): Syncs automatically when Products and Classifications are configured as Product: Windows 11, Classification: Security Updates.
Prerequisite note: Use KB5027397 to update a device to Windows 11, version 23H2 before applying this update.
To remove only the LCU after installing the combined SSU and LCU package, use the DISM /online /remove-package command with the LCU package name as the argument. Running wusa.exe with the /uninstall switch on the combined package will not work because the package also contains the SSU, which cannot be removed after installation.
Frequently asked questions
Does this update include non-security fixes as well as security fixes?
Yes. In addition to the November 2025 security fixes, this cumulative update includes non-security quality improvements that were first released in last month's optional preview update. Administrators who deployed that preview update will only download the new content not already present on their devices.
What should IT admins do about the Secure Boot certificate expiration?
Certificates on most managed devices are being updated through Windows Update over the coming months. Devices missing the newer certificates will continue to boot and accept updates normally in the meantime. Admins should follow the Secure Boot Playbook for Windows clients and Windows Server, and can verify per-device status in the Windows Security app.
How do I enforce strict HTTP chunk extension parsing after applying this update?
The HTTP.sys fix is controlled by a registry key. Set HttpAllowLenientChunkExtParsing (DWORD) to 0 under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Http\Parameters. This enforces RFC 9112-compliant CRLF termination for chunk extensions and is relevant for environments that use front-end proxy servers.
Can I uninstall this update if I encounter problems?
You can remove the LCU portion by using DISM /online /remove-package with the appropriate package name, which you can identify by running DISM /online /get-packages. Using wusa.exe /uninstall on the combined package will not work because the SSU is bundled inside it, and the SSU itself cannot be removed once installed.
