CVE-2026-124040 CivetWeb through 1.16 HTTP/2 Use-After-Free via Stale Pseudo-Header State
CriticalCVSS 9.2
EPSS 0.51%
- Published
- Updated
- Exploit status
- No public exploit known
Description
CivetWeb through 1.16, when built with USE_HTTP2 and enable_http2 on, contains a use-after-free vulnerability in handle_http2() that retains freed :method and :path pointers. Unauthenticated remote attackers can send a later HEADERS frame omitting these pseudo-headers to influence request method or path seen by access rules, or crash the server.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| azure linux ceph(Azure Linux:3.0) | All versions | No fix listed |
| debian/civetweb(Debian:12) | All versions | No fix listed |
| debian/civetweb(Debian:14) | All versions | No fix listed |
| debian/civetweb(Debian:13) | All versions | No fix listed |
| civetweb | <= 1.16 | No fix listed |
References
- MSRC Security Update Guide vendor-advisory
- Release Notes vendor-advisory
- Debian Security Tracker CVE-2026-124040 vendor-advisory
- GitHub Issue #1379 issue-tracking
- github.com product
- github.com technical-description
- VulnCheck Advisory: CivetWeb through 1.16 HTTP/2 Use-After-Free via Stale Pseudo-Header State third-party-advisory