CivetWeb (<= 1.16)

CivetWeb versions through 1.16 contain a use-after-free vulnerability in the handle_http2 function that may allow unauthenticated remote attackers to bypass access control or cause a denial of service.