CVE-2026-124040: CivetWeb through 1.16 HTTP/2 Use-After-Free via Stale Pseudo-Header State

CivetWeb through 1.16, when built with USEHTTP2 and enablehttp2 on, contains a use-after-free vulnerability in handlehttp2() that retains freed :method and :path pointers. Unauthenticated remote attackers can send a later HEADERS frame omitting these pseudo-headers to influence request method or path seen by access rules, or crash the server.