Read the docs
TI-2026-86093 Aliases CVE-2026-124040GHSA-wj2x-x5pc-4h8r

Use-after-free in CivetWeb HTTP/2 pseudo-header handling

Priority MEDIUM 40CWE-416Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
Present
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-416 and the CVSS impact.

Summary

CivetWeb through 1.16, when built with USE_HTTP2 and enable_http2 on, contains a use-after-free in handle_http2() that keeps freed :method and :path pointers. Unauthenticated remote attackers can send a later HEADERS frame that omits these pseudo-headers to influence the request method or path seen by access rules, or crash the server. The CVSS 4.0 vector rates confidentiality, integrity and availability impact as high.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

CivetWeb through 1.16, when built with USE_HTTP2 and enable_http2 on, contains a use-after-free vulnerability in handle_http2() that retains freed :method and :path pointers. Unauthenticated remote attackers can send a later HEADERS frame omitting these pseudo-headers to influence request method or path seen by access rules, or crash the server.

Why it matters now

EPSS 0.00514 44th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
CivetWebcivetwebup to 1.16—No fix listedCNA
  • civetweb VendorCivetWeb Affected up to 1.16 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for civetweb.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Timeline

  1. 2026-11-06 Threatist record created from CVE-2026-124040
  2. 2026-11-06 Alias added: GHSA-wj2x-x5pc-4h8r

References

Other 3

  • TI-2025-08840 Denial of Service in CivetWeb CVSS 4.0HIGH 8.7
  • TI-2026-23182 CivetWeb Heap/Stack Buffer Overflow via WebSocket permessage-deflate Decompression CVSS 4.0HIGH 8.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences