CVE-2026-124040: use-after-free in CivetWeb HTTP/2

CVE-2026-124040 describes a use-after-free vulnerability in the CivetWeb web server version 1.16 and earlier when built with USE_HTTP2 and HTTP/2 enabled. The flaw exists in the handle_http2() function, which retains freed pointers to HTTP/2 pseudo-headers :method and :path. Unauthenticated attackers can send subsequent HEADERS frames lacking these pseudo-headers to influence request interpretation or crash the server.

The official CVSS score is 8.1 (High). The vulnerability enables access rule bypass and denial of service. It was published on NVD on November 6, 2026, and reported on GitHub on November 8: this indicates that public repositories declare containing exploit or proof-of-concept code. No active exploitation in production environments has been confirmed at the time of publication.

Administrators must verify whether CivetWeb is deployed in managed environments and if HTTP/2 is enabled in the build. If both conditions exist, plan an upgrade to a version later than 1.16 as soon as available. In the interim, monitor HTTP/2 traffic for anomalous requests, disable HTTP/2 if feasible, and review server crash logs. Distributions embedding CivetWeb must be checked for dedicated patches.