Skip to content
OpenAdvisories

Vendor

CivetWeb

4 known vulnerabilities.

Products

CivetWeb 4
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.1
    CVE-2026-124040 Public exploit

    CivetWeb through 1.16 HTTP/2 Use-After-Free via Stale Pseudo-Header State

    CivetWeb through 1.16, when built with USE_HTTP2 and enable_http2 on, contains a use-after-free vulnerability in handle_http2() that retains freed :method and :path pointers. Unauthenticated remote attackers can send a later HEADERS frame omitting these pseud…

    CivetWeb CivetWeb civetweb civetweb Debian Ubuntu
  • High 8.5
    CVE-2026-5789

    Search path without quotes in CivetWeb

    Vulnerability related to an unquoted search path in CivetWeb v1.16. This vulnerability allows a local attacker to execute arbitrary code with elevated privileges by placing a malicious executable in a directory that is scanned before the intended application …

    CivetWeb CivetWeb civetweb Ubuntu
  • High 8.7
    CVE-2025-9648

    Denial of Service in CivetWeb

    A vulnerability in the CivetWeb library's function mg_handle_form_request allows remote attackers to trigger a denial of service (DoS) condition. By sending a specially crafted HTTP POST request containing a null byte in the payload, the server enters an infi…

    CivetWeb CivetWeb civetweb civetweb Debian Ubuntu