CVE-2026-124040— CivetWeb through 1.16 HTTP/2 Use-After-Free via Stale Pseudo-Header State

Quick assessment

Affected

civetweb civetweb

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

CivetWeb 1.16 及更早版本在启用编译选项且开启功能时，其函数中存在一个释放后使用（use-after-free）漏洞。该漏洞会导致已释放的和伪头指针被错误保留。未经身份验证的远程攻击者可发送后续省略这些伪头的 HEADERS 帧，从而操纵访问规则所识别的请求方法或路径，甚至导致服务器崩溃。

CVSS 8.1 · High Updated Nov 07, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
civetweb	civetweb	`≤ 1.16`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

CivetWeb through 1.16 HTTP/2 Use-After-Free via Stale Pseudo-Header State

Source: CVE Program / CVE List V5

Vulnerability Description

CivetWeb through 1.16, when built with USE_HTTP2 and enable_http2 on, contains a use-after-free vulnerability in handle_http2() that retains freed :method and :path pointers. Unauthenticated remote attackers can send a later HEADERS frame omitting these pseudo-headers to influence request method or path seen by access rules, or crash the server.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

释放后使用

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
civetweb	civetweb	0 ~ 1.16	-

II. Public POCs for CVE-2026-124040

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-124040

请登录查看更多情报信息。

Other References for CVE-2026-124040 (3)

https://github.com/civetweb/civetweb/blob/v1.16/src/http2.inl#L1574-L1581 technical-description
https://github.com/civetweb/civetweb/issues/1379 issue-tracking
https://www.vulncheck.com/advisories/civetweb-through-1.16-http-2-use-after-free-via-stale-pseudo-header-state third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-124040

IV. Related Vulnerabilities

Same product: civetweb

Same vendor: civetweb

Same weakness: CWE-416