CVE Alert: CVE-2026-124040 – civetweb

CivetWeb through 1.16, when built with USE_HTTP2 and enable_http2 on, contains a use-after-free vulnerability in handle_http2() that retains freed :method and :path pointers. Unauthenticated remote attackers can send a later HEADERS frame omitting these pseudo-headers to influence request method or path seen by access rules, or crash the server.

**Risk verdict:** This is a potentially serious remotely reachable flaw, but urgency cannot be confirmed because exploitation and prioritisation flags were not provided.

**Why this matters:** A successful attack could disrupt service or cause requests to be interpreted differently from what access controls expect, potentially exposing or altering application data. Realistic goals include denial of service and bypassing request-level restrictions; the latter depends on how the host application applies authorisation. KEV, SSVC, PoC and EPSS status are unknown, so active exploitation cannot be ruled in or out.

**Most likely attack path:** An unauthenticated attacker reaches a server over the network and uses a particular sequence of HTTP/2 frames, with the relevant HTTP/2 feature enabled. High complexity and a required attack condition make exploitation less straightforward, but no user action or account is needed; scope is unchanged, so direct impact appears confined to the vulnerable service.

**Who is most exposed:** Prioritise internet-facing deployments and embedded applications that compile in and enable HTTP/2. Inventory is uncertain where CivetWeb is statically bundled or not separately identified.

Look for HTTP/2 HEADERS sequences omitting expected pseudo-headers.

Correlate unusual method or path values with access-control decisions.

Alert on service crashes, restarts or abrupt connection resets.

Review HTTP/2 access and error logs around suspicious requests.

Mitigation and prioritisation

Identify affected builds and confirm whether HTTP/2 is enabled.

Upgrade to a vendor-fixed release when available; verify the fix before deployment.

Temporarily disable HTTP/2 or restrict exposure if operationally safe.

Test access-control behaviour and service stability in staging before rollout.

Obtain current KEV, SSVC, PoC and EPSS data to refine urgency.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.