CivetWeb: Use-after-free in handle_http2 (CVE-2026-124040)
CivetWeb versions through 1.16 contain a use-after-free vulnerability in the handle_http2 function that may allow unauthenticated remote attackers to bypass access control or cause a denial of service.
CVE search metadata
CVE search record: CVE-2026-124040. Severity: high. CVSS: 8.1. KEV: no. Product: CivetWeb (<= 1.16). Brief: CivetWeb: Use-after-free in handle_http2 (CVE-2026-124040). Brief link: https://feed.craftedsignal.io/briefs/2026-11-civetweb-uaf/
Triage facts
Revision 1- Applicability
- CivetWeb (<= 1.16)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 6, 21:29 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
CivetWeb through 1.16 is vulnerable to a use-after-free in the handle_http2() function when the server is compiled with USE_HTTP2 and the enable_http2 configuration is set to on. The vulnerability occurs because the server retains pointers to freed :method and :path pseudo-headers. An unauthenticated attacker can exploit this by sending a crafted HEADERS frame that omits these pseudo-headers, potentially leading to server crashes or the manipulation of request methods and paths to bypass configured access rules.
Impact
Remote unauthenticated attackers may cause a service crash (denial of service) or influence the internal request processing state to bypass access control restrictions.
Recommendation
- Inventory systems running CivetWeb to determine if the USE_HTTP2 build flag is active and enable_http2 is configured.
- Disable HTTP/2 support in the CivetWeb configuration if it is not required for production services.
- Monitor vendor security bulletins for the release of a patched version of CivetWeb and prioritize deployment.
Immediate actions
Identify CivetWeb deployments and verify current configuration for HTTP/2.
Threat Hunt
Identify repeated application crashes or service restarts in CivetWeb logs.
Data: Web server error logs, System crash reports, HTTP/2 traffic logs
Mitigations
Disable HTTP/2 in CivetWeb configuration (enable_http2 = off) until a patched version is available.
CVE-2026-124040