Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Vendor: CivetWeb Clear all filters
TI-2026-86093 CVE-2026-124040 · GHSA-wj2x-x5pc-4h8r

Use-after-free in CivetWeb HTTP/2 pseudo-header handling

Priority MEDIUM 40

CivetWeb through 1.16, when built with USE_HTTP2 and enable_http2 on, contains a use-after-free vulnerability in handle_http2() that retains freed :method and :path pointers.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00514 Published 2026-11-06 No fix listed CWE-416
TI-2026-23182 CVE-2026-29035 · GHSA-xvrx-cw3m-h23c

CivetWeb Heap/Stack Buffer Overflow via WebSocket permessage-deflate Decompression

Priority LOW 37

CivetWeb (commit 4a4f0c95) contains a heap and stack buffer overflow vulnerability in the read_websocket() function that allows unauthenticated remote attackers to corrupt memory by sending compressed WebSocket frames wh…

CVSS 4.0HIGH 8.3 Network No auth No interaction EPSS 0.00612 Published 2026-08-11 No fix listed CWE-787
TI-2025-08840 CVE-2025-9648 · GHSA-2gxg-pvm2-2p6x

Denial of Service in CivetWeb

Priority MEDIUM 45

A vulnerability in the CivetWeb library's function mg_handle_form_request allows remote attackers to trigger a denial of service (DoS) condition.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00756 Published 2025-09-29 Fixed CWE-158