CivetWeb HTTP/2 use-after-free lets attackers bypass access rules or crash server
A web server library can be stopped or bypassed by remote attackers.
Summary
A use-after-free flaw in CivetWeb's HTTP/2 request handling lets an unauthenticated remote attacker change the request method or path seen by access rules, or crash the server. It affects 1.16 and older built with USE_HTTP2 and enable_http2 turned on.
Affected when
- built with USE_HTTP2 and enable_http2 turned on
- CivetWeb 1.16 or older
What to do
No fixed version is named. Check that you run a version newer than 1.16, and read the vendor's advisory.
Products and platforms
CVE IDs
Sources
- Write-up: github.com (opens in a new tab) · vulncheck.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen