CVE-2026-124040: civetweb (Critical, CVSS 9.2)
- CVSS
- 9.2 Critical (v4.0)
- EPSS
- 0.5% chance of exploitation in the next 30 days (higher than 44% of CVEs)
- Exploited in the wild
- Not on CISA’s KEV list
- Public exploit
- None reported in public exploit databases
- Weakness
- CWE-416
- Vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N- Published
- Nov 6, 2026
What it is
CivetWeb through 1.16, when built with USE_HTTP2 and enable_http2 on, contains a use-after-free vulnerability in handle_http2() that retains freed :method and :path pointers. Unauthenticated remote attackers can send a later HEADERS frame omitting these pseudo-headers to influence request method or path seen by access rules, or crash the server.
Description from the National Vulnerability Database.
What to do
Check whether you run civetweb, then apply the vendor’s fix or mitigation from the advisories below.
Sources: NVD, FIRST EPSS, CISA KEV, and public exploit databases (availability only). ThreatRoundup reports whether public exploit code exists but never links to it: fake proof-of-concepts that infect security researchers are common. This page updates automatically.