CVE-2026-124040

Name of the Vulnerable Software and Affected Versions CivetWeb versions prior to 1.17

Description When built with USE HTTP2 and enable http2 enabled, the software contains a use-after-free issue in the handle http2() function. This occurs because the system retains freed :method and :path pointers. An unauthenticated remote attacker can send a subsequent HEADERS frame that omits these pseudo-headers to manipulate the request method or path evaluated by access rules, or cause the server to crash. A use-after-free is a memory corruption issue where an application continues to use a pointer after it has been freed, potentially leading to arbitrary code execution or system instability.

Recommendations Update to a version newer than 1.16. As a temporary mitigation, disable the enable http2 option or rebuild the software without USE HTTP2.