{"id":"CVE-2026-124040","kind":"vulnerability","aliases":["CVE-2026-124040"],"related":[],"title":"CivetWeb: HTTP/2 use-after-free lets remote requests bypass access rules or crash","description":"CivetWeb through 1.16, when built with USE_HTTP2 and enable_http2 on, contains a use-after-free vulnerability in handle_http2() that retains freed :method and :path pointers. Unauthenticated remote attackers can send a later HEADERS frame omitting these pseudo-headers to influence request method or path seen by access rules, or crash the server.","summary":"CivetWeb, an embedded C web server, has a use-after-free in its HTTP/2 handler when built with USE_HTTP2 and enable_http2 turned on. An unauthenticated remote attacker can send a crafted HEADERS frame to change the request method or path seen by access rules, or crash the server.","severity":"critical","cvss":9.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"civetweb","fixed":[],"affected":"<= 1.16 (only builds with USE_HTTP2 and enable_http2 on)","ecosystem":"vendor"}],"ecosystems":[],"tags":["c","civetweb","embedded-web-server","http2","runtime"],"not_affected_if":["default-config","http2-disabled"],"how_to_check":"- Check whether your build defines USE_HTTP2 (e.g. grep your Makefile/CMake flags) and whether enable_http2 is set to yes in civetweb.conf or the mg_start options.\\n- Check the CivetWeb version; 1.16 and earlier are listed as affected.\\n- If HTTP/2 is off (the default), you are not exposed per the advisory. Workaround until a fix: build without USE_HTTP2 or leave enable_http2 off.","fix":"No fixed CivetWeb release is known; latest release named in sources is 1.16, which is affected. Tracking issue #1379 is open.","status":"open","published_at":"2026-11-06T20:17:22+00:00","first_seen_at":"2026-11-06T20:43:59+00:00","triaged_at":"2026-11-06T20:44:10+00:00","updated_at":"2026-11-06T20:45:02+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-06T20:44:10Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"CivetWeb: HTTP/2 use-after-free lets remote requests bypass access rules or crash","impact":"high","summary":"CivetWeb, an embedded C web server, has a use-after-free in its HTTP/2 handler when built with USE_HTTP2 and enable_http2 turned on. An unauthenticated remote attacker can send a crafted HEADERS frame to change the request method or path seen by access rules, or crash the server.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["civetweb","c","embedded-web-server","http2"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Remote attacker bypasses access rules or crashes the server","analyst_note":"Find a fixed CivetWeb version and the vendor or CVE page (vulncheck advisory linked in sources) to confirm the fix and the exact affected build options.","how_to_check":"- Check whether the build defines `USE_HTTP2` and whether `enable_http2` is set to on in the server configuration.\n- Check the CivetWeb version in use; the sources describe all versions through `1.16`.","plain_action":"","needs_analyst":true,"not_affected_if":["http2-disabled","default-config"],"who_is_affected":"Only builds compiled with USE_HTTP2 and running with enable_http2 on appear exposed, according to the description. Servers that expose CivetWeb to the network and rely on method or path access rules are the most at risk. Deployments without HTTP/2 enabled are not described as affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000721,"input_tokens":4278,"output_tokens":586,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find a fixed CivetWeb version and the vendor or CVE page (vulncheck advisory linked in sources) to confirm the fix and the exact affected build options.","search":"'-124040':17A,20A '-2026':16A,19A '1.16':83C 'access':11A,75B,132C 'attack':59B,112C 'built':47B,85C 'bypass':10A 'c':22B,33B 'chang':67B 'civetweb':1A,21A,23B,30B,81C 'contain':93C 'craft':63B 'crash':14A,78B,135C 'cve':15A,18A 'embed':25B,32B 'embedded-web-serv':24B 'enabl':52B,90C 'frame':65B,118C 'free':6A,41B,98C 'freed':105C 'handl':101C 'handler':45B 'header':64B,117C,123C 'http/2':2A,44B 'http2':28B,50B,53B,88C,91C,102C 'influenc':125C 'later':116C 'let':7A 'method':70B,106C,127C 'omit':119C 'path':72B,108C,129C 'pointer':109C 'pseudo':122C 'pseudo-head':121C 'remot':8A,58B,111C 'request':9A,69B,126C 'retain':104C 'rule':12A,76B,133C 'runtim':29B 'seen':73B,130C 'send':61B,114C 'server':27B,35B,80B,137C 'turn':54B 'unauthent':57B,110C 'use':4A,39B,49B,87C,96C 'use-after-fre':3A,38B,95C 'vulner':99C 'web':26B,34B","nicknames":[],"mitigations":[],"who_affected":"Only builds compiled with USE_HTTP2 and running with enable_http2 on appear exposed, according to the description. Servers that expose CivetWeb to the network and rely on method or path access rules are the most at risk. Deployments without HTTP/2 enabled are not described as affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["civetweb"],"ptokens":["civetweb"],"labels":["c","civetweb","critical","embeddedwebserver","http2","runtime"],"campaign_type":null,"search_a":"'-124040':17A,20A '-2026':16A,19A 'access':11A 'bypass':10A 'civetweb':1A,21A 'crash':14A 'cve':15A,18A 'free':6A 'http/2':2A 'let':7A 'remot':8A 'request':9A 'rule':12A 'use':4A 'use-after-fre':3A","search_b":"'access':75B 'attack':59B 'built':47B 'c':22B,33B 'chang':67B 'civetweb':23B,30B 'craft':63B 'crash':78B 'embed':25B,32B 'embedded-web-serv':24B 'enabl':52B 'frame':65B 'free':41B 'handler':45B 'header':64B 'http/2':44B 'http2':28B,50B,53B 'method':70B 'path':72B 'remot':58B 'request':69B 'rule':76B 'runtim':29B 'seen':73B 'send':61B 'server':27B,35B,80B 'turn':54B 'unauthent':57B 'use':39B,49B 'use-after-fre':38B 'web':26B,34B","search_c":"'1.16':83C 'access':132C 'attack':112C 'built':85C 'civetweb':81C 'contain':93C 'crash':135C 'enabl':90C 'frame':118C 'free':98C 'freed':105C 'handl':101C 'header':117C,123C 'http2':88C,91C,102C 'influenc':125C 'later':116C 'method':106C,127C 'omit':119C 'path':108C,129C 'pointer':109C 'pseudo':122C 'pseudo-head':121C 'remot':111C 'request':126C 'retain':104C 'rule':133C 'seen':130C 'send':114C 'server':137C 'unauthent':110C 'use':87C,96C 'use-after-fre':95C 'vulner':99C","first_public_at":"2026-11-06T20:17:22+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124040","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124040","severity":null,"published_at":"2026-11-06T20:17:22+00:00","modified_at":"2026-11-06T20:17:22+00:00","first_seen_at":"2026-11-06T20:43:59+00:00","fetched_at":"2026-11-06T20:43:59+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-124040:1930","url":"https://github.com/civetweb/civetweb/issues/1379","severity":null,"published_at":"2026-11-06T20:45:02+00:00","modified_at":"2026-11-06T20:45:02+00:00","first_seen_at":"2026-11-06T20:45:02+00:00","fetched_at":"2026-11-06T20:45:02+00:00","note":"VulnCheck advisory (third party) says <=1.16, credit PuH4ck3rX; reporter issue #1379 on civetweb GitHub is still open with no maintainer fix or release found. No vendor advisory, so nothing marked verified; fix unknown. No PoC or exploitation seen. 'default-config' not-affected tag is unconfirmed in sources.","cites":["https://github.com/civetweb/civetweb/issues/1379"]}],"documents":[{"id":89788,"url":"https://www.vulncheck.com/advisories/civetweb-through-1.16-http-2-use-after-free-via-stale-pseudo-header-state","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"},{"id":89882,"url":"https://github.com/civetweb/civetweb/issues/1379","title":"CivetWeb #1379: suspected memory-safety issues in WebSocket and HTTP/2 paths (open)","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}