UBUNTU-CVE-2026-124040: Use After Free
CivetWeb through 1.16, when built with USEHTTP2 and enablehttp2 on, contains a use-after-free vulnerability in handlehttp2() that retains freed :method and :path pointers. Unauthenticated remote attackers can send a later HEADERS frame omitting these pseudo-headers to influence request method or path seen by access rules, or crash the server.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Only CivetWeb deployments built with USE_HTTP2 and running with enable_http2 enabled are described as affected. The issue applies through version 1.16.
What does an attacker need to exploit this?
The attacker does not need authentication or user interaction. Exploitation requires sending a later HTTP/2 HEADERS frame that omits the :method and :path pseudo-headers.
What can exploitation do?
An attacker may influence the request method or path evaluated by access rules, potentially bypassing intended rule decisions. They may also crash the server.
What can be done if patching is not immediately possible?
Disable HTTP/2 by ensuring enable_http2 is not enabled, or use a build without USE_HTTP2. This removes the affected HTTP/2 handling path described in the advisory.