Bug 2568466 (CVE-2026-124040)

Summary: CVE-2026-124040 civetweb: CivetWeb through 1.16 HTTP/2 Use-After-Free via Stale Pseudo-Header State
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: urgent Docs Contact:
Priority: urgent    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in CivetWeb. When HTTP/2 support is enabled, the server retains memory references to previously freed request pseudo-headers. An unauthenticated remote attacker can exploit this use-after-free vulnerability by sending specially crafted HTTP/2 frames that omit these headers. A successful attack may allow the adversary to bypass access control rules by altering the evaluated request method or path, or crash the server, leading to a Denial of Service (DoS).
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-11-06 19:21:40 UTC 
CivetWeb through 1.16, when built with USE_HTTP2 and enable_http2 on, contains a use-after-free vulnerability in handle_http2() that retains freed :method and :path pointers. Unauthenticated remote attackers can send a later HEADERS frame omitting these pseudo-headers to influence request method or path seen by access rules, or crash the server.
Comment 2 Tomas Hoger 2026-11-09 14:36:18 UTC 
HTTP2 support is marked upstream as "experimental, not recommended for production", and it not enabled in Fedora / EPEL civetweb (and root bundling civetweb) packges.