Vendor
CivetWeb versions through 1.16 contain a use-after-free vulnerability in the handle_http2 function that may allow unauthenticated remote attackers to bypass access control or cause a denial of service.