CivetWeb through 1.16 HTTP/2 Use-After-Free via Stale Pseudo-Header State

Summary

CivetWeb through 1.16, when built with USE_HTTP2 and enable_http2 on, contains a use-after-free vulnerability in handle_http2() that retains freed :method and :path pointers. Unauthenticated remote attackers can send a later HEADERS frame omitting these pseudo-headers to influence request method or path seen by access rules, or crash the server.

Remediation

1. Inventory every civetweb civetweb deployment, including staging.
2. No fixed version appears in the public sources yet. Check the references below and the vendor directly.

References

• Advisoryhttps://www.vulncheck.com/advisories/civetweb-through-1.16-http-2-use-after-free-via-stale-pseudo-header-state
• Referencehttps://github.com/civetweb/civetweb/issues/1379
• Referencehttps://github.com/civetweb/civetweb
• Referencehttps://github.com/civetweb/civetweb/blob/v1.16/src/http2.inl#L1574-L1581