Skip to content
Critical RCE Vulnerability in CivetWeb HTTP/2 Disclosed

Critical RCE Vulnerability in CivetWeb HTTP/2 Disclosed

First seen 8 Nov 2026, 12:46 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 8, 2026 at 12:46 UTC
  • •CVE-2026-124040 allows RCE via HTTP/2 in CivetWeb versions 1.13-1.16.
  • •The vulnerability has a CVSS score of 9.2, marking it as critical.
  • •No confirmed exploitation has been reported, but the risk is significant.

CVE-2026-124040, a critical use-after-free vulnerability in CivetWeb versions 1.13 to 1.16, allows unauthenticated remote attackers to exploit HTTP/2 header handling. The flaw enables attackers to manipulate request methods and paths, potentially leading to remote code execution under specific conditions. CivetWeb's handling of freed pointers in HTTP/2 requests can be exploited if the server is configured with HTTP/2 enabled. The vulnerability was published on November 6, 2026, with a CVSS score of 9.2, indicating a critical severity level. Affected systems include internet-facing deployments and embedded applications using CivetWeb. No active exploitation has been confirmed yet, but the risk remains significant due to the nature of the vulnerability. Users are advised to monitor for unusual HTTP/2 traffic and prepare for patching once a fix is available.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 3h ago How this analysis works

Timeline

2026-11-06
CVE-2026-124040 published
CVE-2026-124040 disclosed, detailing a critical use-after-free vulnerability in CivetWeb.
Redpacketsecurity
2026-11-08
Exploit details released
Sploitus published a detailed analysis of the exploit chain for CVE-2026-124040, highlighting conditions for RCE.
Sploitus

More articles in this cluster (2)

Following this threat?

Track CVE-2026-124040 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (6)

1 / 3

Common questions

Which versions of CivetWeb are affected?
CivetWeb versions 1.13 to 1.16 are affected when built with HTTP/2 enabled.
Is there a patch available?
No patch has been released yet; users should monitor for updates from the vendor.
What should I do if I use CivetWeb?
Review your configurations for HTTP/2 and prepare to apply patches once they are available.