Cpe:2.3:a:civetweb:civetweb:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3acivetwebcivetweb/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 06 Nov 2026 21:29:08 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgCivetWeb: Use-after-free in handle_http2 (CVE-2026-124040)https://feed.craftedsignal.io/briefs/2026-11-civetweb-uaf/Fri, 06 Nov 2026 21:29:08 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-civetweb-uaf/CivetWeb versions through 1.16 contain a use-after-free vulnerability in the handle_http2 function that may allow unauthenticated remote attackers to bypass access control or cause a denial of service.CivetWeb through 1.16 is vulnerable to a use-after-free in the handle_http2() function when the server is compiled with USE_HTTP2 and the enable_http2 configuration is set to on. The vulnerability occurs because the server retains pointers to freed :method and :path pseudo-headers. An unauthenticated attacker can exploit this by sending a crafted HEADERS frame that omits these pseudo-headers, potentially leading to server crashes or the manipulation of request methods and paths to bypass configured access rules.

Impact

Remote unauthenticated attackers may cause a service crash (denial of service) or influence the internal request processing state to bypass access control restrictions.

Recommendation

  • Inventory systems running CivetWeb to determine if the USE_HTTP2 build flag is active and enable_http2 is configured.
  • Disable HTTP/2 support in the CivetWeb configuration if it is not required for production services.
  • Monitor vendor security bulletins for the release of a patched version of CivetWeb and prioritize deployment.
]]>highadvisory