Description

CivetWeb through 1.16, when built with USE_HTTP2 and enable_http2 on, contains a use-after-free vulnerability in handle_http2() that retains freed :method and :path pointers. Unauthenticated remote attackers can send a later HEADERS frame omitting these pseudo-headers to influence request method or path seen by access rules, or crash the server.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-11-06T20:17:22.203Z",
  "pubdate": "2026-11-06T20:17:22.203Z",
  "executiveSummary": "A use-after-free vulnerability exists in CivetWeb (up to version 1.16) when the USE_HTTP2 build flag is enabled and HTTP/2 functionality is active. This flaw occurs within the handle_http2() function, which fails to correctly manage the memory lifecycle of :method and :path pseudo-header pointers.\nThe vulnerability allows an unauthenticated remote attacker to trigger memory corruption or influence the server's request handling logic. By sending specifically crafted HTTP/2 HEADERS frames that omit previously established pseudo-headers, an attacker can cause the server to reference freed memory addresses. This can lead to process crashes (denial of service) or potential security bypasses where the server incorrectly evaluates access rules based on corrupted method or path data. The vulnerability represents a high risk for systems exposed to the internet that utilize CivetWeb's HTTP/2 support, as it requires no prior authentication or elevated privileges for exploitation.",
  "technicalDetails": "The root cause of this vulnerability is improper memory management in the handle_http2() function during the processing of HTTP/2 stream state transitions. In the HTTP/2 protocol, pseudo-headers like :method and :path are critical for defining request parameters. In the affected versions of CivetWeb, the internal data structures tracking these values do not adequately nullify or re-initialize pointers after the memory associated with these pseudo-headers is deallocated.\nThe exploitation flow begins when an attacker initiates an HTTP/2 connection and sends a valid initial HEADERS frame containing the mandatory :method and :path pseudo-headers, which are then cached by the server. Subsequently, the attacker sends a malformed or subsequent HEADERS frame that omits these fields. Because the pointers for these values were not invalidated during the transition of the HTTP/2 stream state, the server attempts to reference the previously freed memory addresses when processing the request context.\nThis use-after-free (UAF) condition exposes the server to two primary attack vectors: First, if the memory region has been reclaimed by the allocator for other operations, the server will interpret the new data as if it were the original :method or :path values. By influencing the state of the heap, an attacker might force the application to treat an unauthorized request as authorized, effectively bypassing path-based access controls or altering the intended HTTP method (e.g., changing a restricted request to a safe GET). Second, if the memory is unmapped or inaccessible, the application will trigger a segmentation fault, leading to a denial-of-service condition.\nThe vulnerability is restricted to environments where USE_HTTP2 is defined at compile time and the server is configured with enable_http2 set to on. The attack is network-exposed, requiring only the ability to establish an HTTP/2 connection with the target server. Because the handling logic for these pseudo-headers is performed early in the request processing pipeline, the attacker does not need to bypass higher-level authentication or authorization checks to trigger the memory corruption. The persistence of the stale pointers ensures that the vulnerability can be leveraged repeatedly within the lifetime of the HTTP/2 session."
}