DEBIAN-CVE-2026-124040: Use After Free

Published Nov 6, 2026

Updated

CivetWeb through 1.16, when built with USEHTTP2 and enablehttp2 on, contains a use-after-free vulnerability in handlehttp2() that retains freed :method and :path pointers. Unauthenticated remote attackers can send a later HEADERS frame omitting these pseudo-headers to influence request method or path seen by access rules, or crash the server.

Affected Software

3 affected components

debian/civetweb*

Event History

Nov 6, 2026

CVE Published

via OSV·08:17 PM

Data Sourced

via OSV·08:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed?

Only CivetWeb deployments built with USE_HTTP2 and running with enable_http2 enabled are described as affected. Systems without that build option or with HTTP/2 disabled are not identified as exposed by the available data.

What does an attacker need to exploit this issue?

The issue is exploitable remotely without authentication. An attacker sends a later HTTP/2 HEADERS frame that omits the :method and :path pseudo-headers after those pointers have been freed.

What can exploitation cause?

An attacker may influence the request method or path evaluated by access rules, or crash the server. The provided information does not establish impacts beyond access-rule confusion and denial of service.

What is a mitigation if an update cannot be applied immediately?

Disable HTTP/2 by turning off enable_http2 where operationally feasible. Deployments not built with USE_HTTP2 are also not described as affected.

DEBIAN-CVE-2026-124040: Use After Free

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

What can exploitation cause?

What is a mitigation if an update cannot be applied immediately?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

What can exploitation cause?

What is a mitigation if an update cannot be applied immediately?