The IIS 10.0 websites Maximum Query String limit must be configured.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-218755	IIST-SI-000227	SV-218755r961152_rule	CCI-001094	medium
Description
Setting limits on web requests helps to ensure availability of web services and may also help mitigate the risk of buffer overflow type attacks. The Maximum Query String Request Filter describes the upper limit on allowable query string lengths. Upon exceeding the configured value, IIS will generate a Status Code 404.15.
STIG			Date
Microsoft IIS 10.0 Site Security Technical Implementation Guide			2026-05-23

Related Frameworks

1 mapping across 4 frameworks

SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

CAP-02Resource Priority

0.50

DISA STIG Benchmark (XCCDF)V2R16intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)
SCF Secure Traceability Relationship Mapping (STRM)2026.2intersects

NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (16) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-3Access Enforcement

1.00

DISA STIG Benchmark (XCCDF)V2R16intersects(normalised)
DISA STIG Benchmark (XCCDF)V2R1our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V2R1intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

AC-6(10)Prohibit Non-privileged Users from Executing Privileged Functions

1.00

DISA STIG Benchmark (XCCDF)V2R16intersects(normalised)
DISA STIG Benchmark (XCCDF)1our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)1intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

AC-6(8)Privilege Levels for Code Execution

1.00

DISA STIG Benchmark (XCCDF)V2R16intersects(normalised)
DISA STIG Benchmark (XCCDF)2our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

CM-11(2)Software Installation with Privileged Status

1.00

DISA STIG Benchmark (XCCDF)V2R16intersects(normalised)
DISA STIG Benchmark (XCCDF)V2R1our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V2R1intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

CM-5(1)Automated Access Enforcement and Audit Records

1.00

DISA STIG Benchmark (XCCDF)V2R16intersects(normalised)
DISA STIG Benchmark (XCCDF)V2R1our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V2R1intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

CM-5(6)Limit Library Privileges

1.00

DISA STIG Benchmark (XCCDF)V2R16intersects(normalised)
DISA STIG Benchmark (XCCDF)1our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)1intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

CM-6Configuration Settings

1.00

DISA STIG Benchmark (XCCDF)V2R16intersects(normalised)
DISA STIG Benchmark (XCCDF)2our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

CM-7Least Functionality

1.00

DISA STIG Benchmark (XCCDF)V2R16intersects(normalised)
DISA STIG Benchmark (XCCDF)1our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)1intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

CM-7(2)Prevent Program Execution

1.00

DISA STIG Benchmark (XCCDF)V2R16intersects(normalised)
DISA STIG Benchmark (XCCDF)1our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)1intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

SC-18(1)Identify Unacceptable Code and Take Corrective Actions

1.00

DISA STIG Benchmark (XCCDF)V2R16intersects(normalised)
DISA STIG Benchmark (XCCDF)1our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)1intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

+6 more (top 10 by confidence shown)

CCI1 mapping

CCI-001094

1.00

DISA STIG Benchmark (XCCDF)V2R16intersects(normalised)

NIST CSF 2.00 mappings

No source states a mapping between these directly.

Also reachable in 4 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

PR.IR-04

0.50

DISA STIG Benchmark (XCCDF)V2R16intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)
SCF Secure Traceability Relationship Mapping (STRM)2026.2intersects
NIST OLIR Informative ReferenceOLIR 153 (2025-04-07)intersects(normalised)SCF Focal Document mapping (catalog)SCF 2026.2 focalintersects(normalised)

Details

Check Text (C-218755r961152_chk)

Follow the procedures below for each site hosted on the IIS 10.0 web server: Open the IIS 10.0 Manager. Click the site name. Double-click the "Request Filtering" icon. Click “Edit Feature Settings” in the "Actions" pane. If the "Maximum Query String" value is not set to "2048" or less, this is a finding.

Fix Text (F-20226r311164_fix)

Follow the procedures below for each site hosted on the IIS 10.0 web server: Open the IIS 10.0 Manager. Click the site name under review. Double-click the "Request Filtering" icon. Click "Edit Feature Settings" in the "Actions" pane. Set the "Maximum Query String" value to "2048" or less.