---
id: "CVE-2026-124040"
page: "https://infrastack.ai/live/CVE-2026-124040"
kind: "vulnerability"
aliases: ["CVE-2026-124040"]
title: "CivetWeb: HTTP/2 use-after-free lets remote requests bypass access rules or crash"
severity: "critical"
cvss: 9.2
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "civetweb", "fixed": [], "affected": "<= 1.16 (only builds with USE_HTTP2 and enable_http2 on)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["c", "civetweb", "embedded-web-server", "http2", "runtime"]
not_affected_if: ["default-config", "http2-disabled"]
published_at: "2026-11-06T20:17:22+00:00"
first_seen_at: "2026-11-06T20:43:59+00:00"
updated_at: "2026-11-06T20:45:02+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124040", "first_seen_at": "2026-11-06T20:43:59+00:00"}, {"source": "analyst", "url": "https://github.com/civetweb/civetweb/issues/1379", "first_seen_at": "2026-11-06T20:45:02+00:00", "cites": ["https://github.com/civetweb/civetweb/issues/1379"]}]
exploit_sources: []
---

# CivetWeb: HTTP/2 use-after-free lets remote requests bypass access rules or crash

Link for people: https://infrastack.ai/live/CVE-2026-124040 (this .md is for agents)

CivetWeb, an embedded C web server, has a use-after-free in its HTTP/2 handler when built with USE_HTTP2 and enable_http2 turned on. An unauthenticated remote attacker can send a crafted HEADERS frame to change the request method or path seen by access rules, or crash the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:civetweb affected <= 1.16 (only builds with USE_HTTP2 and enable_http2 on) fixed no fixed version listed

## How to check

- Check whether your build defines USE_HTTP2 (e.g. grep your Makefile/CMake flags) and whether enable_http2 is set to yes in civetweb.conf or the mg_start options.\n- Check the CivetWeb version; 1.16 and earlier are listed as affected.\n- If HTTP/2 is off (the default), you are not exposed per the advisory. Workaround until a fix: build without USE_HTTP2 or leave enable_http2 off.

## Fix

No fixed CivetWeb release is known; latest release named in sources is 1.16, which is affected. Tracking issue #1379 is open.

## Timeline

- 2026-11-06T20:43:59+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124040
- 2026-11-06T20:45:02+00:00 analyst https://github.com/civetweb/civetweb/issues/1379 — VulnCheck advisory (third party) says <=1.16, credit PuH4ck3rX; reporter issue #1379 on civetweb GitHub is still open with no maintainer fix or release found. No vendor advisory, so nothing marked verified; fix unknown. No PoC or exploitation seen. 'default-config' not-affected tag is unconfirmed in sources.

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/civetweb-through-1.16-http-2-use-after-free-via-stale-pseudo-header-state
- [describes] CivetWeb #1379: suspected memory-safety issues in WebSocket and HTTP/2 paths (open) https://github.com/civetweb/civetweb/issues/1379

## From the sources

CivetWeb through 1.16, when built with USE_HTTP2 and enable_http2 on, contains a use-after-free vulnerability in handle_http2() that retains freed :method and :path pointers. Unauthenticated remote attackers can send a later HEADERS frame omitting these pseudo-headers to influence request method or path seen by access rules, or crash the server.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_