AZL-113116
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-113116.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-113116
- Upstream
- Published
- 2026-11-06T20:17:22Z
- Modified
- 2026-11-14T05:30:17Z
- Summary
- CVE-2026-124040 affecting package ceph 18.2.2-13
- Details
-
CivetWeb through 1.16, when built with USE_HTTP2 and enable_http2 on, contains a use-after-free vulnerability in handle_http2() that retains freed :method and :path pointers. Unauthenticated remote attackers can send a later HEADERS frame omitting these pseudo-headers to influence request method or path seen by access rules, or crash the server.
- References