Linux Distros Unpatched Vulnerability : CVE-2026-124040

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CivetWeb through 1.16, when built with USEHTTP2 and enablehttp2 on, contains a use-after-free vulnerability in handlehttp2 that retains freed :method and :path...

EUVD-2026-118441

CivetWeb through 1.16, when built with USEHTTP2 and enablehttp2 on, contains a use-after-free vulnerability in handlehttp2 that retains freed :method and :path pointers. Unauthenticated remote attackers can send a later HEADERS frame omitting these pseudo-headers to influence request method or pa...

CVE-2026-124040 CivetWeb through 1.16 HTTP/2 Use-After-Free via Stale Pseudo-Header State

CivetWeb through 1.16, when built with USEHTTP2 and enablehttp2 on, contains a use-after-free vulnerability in handlehttp2 that retains freed :method and :path pointers. Unauthenticated remote attackers can send a later HEADERS frame omitting these pseudo-headers to influence request method or pa...

CVE-2026-124040

CivetWeb versions through 1.16 are vulnerable to a use-after-free vulnerability in the handle_http2() function when compiled with USE_HTTP2 and enable_http2 enabled. The flaw occurs because the application retains freed :method and :path pointers. An unauthenticated remote attacker can exploit th...