CVE-2026-124040

CVE

Threat entity extracted from intelligence sources

Frequency

occurrences

First Seen

November 6, 2026

Last Seen

November 8, 2026

API

Exploited in Wild

—

Ransomware Use

—

Public Exploits

—

Attack Vector

—

Vulnerability Overview

Exploitation Activity

Exploitation Intelligence

Critical RCE Vulnerability in CivetWeb HTTP/2 Disclosed73.5

CVE-2026-124040, a critical use-after-free vulnerability in CivetWeb versions 1.13 to 1.16, allows unauthenticated remote attackers to exploit HTTP/2 header handling. The flaw enables attackers to manipulate request methods and paths, potentially leading to remote code execution under specific condi...