Threats affecting pkg:github/civetweb/civetweb

CivetWeb versions up to 1.16, when built with HTTP/2 support enabled, contain a use-after-free vulnerability in the HTTP/2 request handling function. This flaw allows unauthenticated remote attackers to send crafted HEADERS frames that omit critical pseudo-headers, potentially influencing the request method or path used by access rules or causing a server crash.