The bug allowed unprivileged users to trigger use-after-free while
unloading modules
Note that the fix requires a slight API change for OnEmbeddedWebRequest:
now the callers (webadmin is the only known caller of it) call it via
DoEmbeddedWebRequest() instead. The modules which implement this hook
need no changes.
CVE-2026-82373
Found by Claude from Anthropic, reported by Ada Logics.
Alexey Sokolov
4b88c64c6e