CVE-2026-124040

Description

CivetWeb through 1.16, when built with USE_HTTP2 and enable_http2 on, contains a use-after-free vulnerability in handle_http2() that retains freed :method and :path pointers. Unauthenticated remote attackers can send a later HEADERS frame omitting these pseudo-headers to influence request method or path seen by access rules, or crash the server.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

References

• https://github.com/civetweb/civetweb/issues/1379 ↗
• https://github.com/civetweb/civetweb ↗
• https://github.com/civetweb/civetweb/blob/v1.16/src/http2.inl#L1574-L1581 ↗
• https://www.vulncheck.com/advisories/civetweb-through-1.16-http-2-use-after-free-via-stale-pseudo-header-state ↗