IIS is marketted by MS as a VERY capable web server... typically out-performing other web servers by a large margin. The caching system for IIS has always been one of their crowning achievements, working better than most systems. Though, these days most will put a caching server(or cluster) in front of their operations servers. Just the same, it has worked pretty well. Though I predict this feature will be removed, or disabled by default in future versions.

I'm kind of surprised this issue wasn't discovered previously. Fortunately, there doesn't seem to be an exploit beyond crashing the server yet (which is bad enough). (sigh, kind of glad I'm in the process of migrating everything away from IIS).