CVE-2026-124040 CivetWeb through 1.16 HTTP/2 Use-After-Free via Stale Pseudo-Header State
CriticalCVSS 9.2
EPSS 0.51%
- Published
- Updated
- Exploit status
- No public exploit known
Description
CivetWeb through 1.16, when built with USE_HTTP2 and enable_http2 on, contains a use-after-free vulnerability in handle_http2() that retains freed :method and :path pointers. Unauthenticated remote attackers can send a later HEADERS frame omitting these pseudo-headers to influence request method or path seen by access rules, or crash the server.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| azure linux ceph(Azure Linux:3.0) | All versions | No fix listed |
| debian/civetweb(Debian:12) | All versions | No fix listed |
| debian/civetweb(Debian:14) | All versions | No fix listed |
| debian/civetweb(Debian:13) | All versions | No fix listed |
| debian/civetweb(Debian:12) | = 1.15+dfsg-4 | No fix listed |
| debian/civetweb(Debian:12) | = 1.16+dfsg-1 | No fix listed |
| debian/civetweb(Debian:12) | = 1.16+dfsg-2 | No fix listed |
| debian/civetweb(Debian:12) | = 1.16+dfsg-3 | No fix listed |
| debian/civetweb(Debian:12) | = 1.16+dfsg-4 | No fix listed |
| debian/civetweb(Debian:12) | = 1.16+dfsg-5 | No fix listed |
| debian/civetweb(Debian:12) | = 1.16+dfsg-6 | No fix listed |
| debian/civetweb(Debian:13) | = 1.16+dfsg-2 | No fix listed |
| debian/civetweb(Debian:13) | = 1.16+dfsg-2+deb13u1 | No fix listed |
| debian/civetweb(Debian:13) | = 1.16+dfsg-3 | No fix listed |
| debian/civetweb(Debian:13) | = 1.16+dfsg-4 | No fix listed |
| debian/civetweb(Debian:13) | = 1.16+dfsg-5 | No fix listed |
| debian/civetweb(Debian:13) | = 1.16+dfsg-6 | No fix listed |
| debian/civetweb(Debian:14) | = 1.16+dfsg-2 | No fix listed |
| debian/civetweb(Debian:14) | = 1.16+dfsg-3 | No fix listed |
| debian/civetweb(Debian:14) | = 1.16+dfsg-4 | No fix listed |
| debian/civetweb(Debian:14) | = 1.16+dfsg-5 | No fix listed |
| debian/civetweb(Debian:14) | = 1.16+dfsg-6 | No fix listed |
| ubuntu/civetweb(Ubuntu:22.04) | All versions | No fix listed |
| ubuntu/civetweb(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/civetweb(Ubuntu:26.04) | All versions | No fix listed |
Show 2 more
| ubuntu/civetweb(Ubuntu:26.10) | All versions | No fix listed |
| civetweb | <= 1.16 | No fix listed |
References
- MSRC Security Update Guide vendor-advisory
- Release Notes vendor-advisory
- Debian Security Tracker CVE-2026-124040 vendor-advisory
- GitHub Issue #1379 issue-tracking
- github.com product
- github.com technical-description
- VulnCheck Advisory: CivetWeb through 1.16 HTTP/2 Use-After-Free via Stale Pseudo-Header State third-party-advisory
- Ubuntu CVE tracker vendor-advisory
- www.cve.org