CVE-2026-67183
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
TinyWeb through version 0.0.8 has a memory leak vulnerability allowing unauthenticated attackers to exhaust available memory by sending ordinary well-formed HTTP requests. Each request allocates Url, HttpHeaders, and HttpHeader objects via raw new expressions that are never freed due to missing destructors and unreachable delete calls, causing worker memory to grow by ~20-28 kB per request until the process is killed.
Risk Assessment
An attacker can exhaust server memory, causing worker process crashes and denial of service (DoS), making the application unavailable.
Recommendation
Upgrade TinyWeb to a version above 0.0.8 that includes memory deallocation fixes with destructors and proper delete calls.
Other vulnerabilities in TinyWeb
See all- CVE-2026-22781Critical
TinyWeb HTTP Server before version 1.98 is vulnerable to OS command injection via CGI ISINDEX-style query parameters. The parameters are passed as command-line arguments to the CGI executable via Windows CreateProcess(). An unauthenticated remote attacker can execute arbitrary commands on the server by injecting Windows shell metacharacters into HTTP requests. This vulnerability is fixed in 1.98.
- CVE-2026-67185High
TinyWeb through version 0.0.8 has a path traversal vulnerability allowing unauthenticated attackers to read arbitrary files by submitting ../ sequences in the URL path. The path is concatenated without normalization, dot-segment removal, or boundary checks. Attackers can expose sensitive files like credential stores and private keys when the server runs as root.
- CVE-2026-67184High
TinyWeb through version 0.0.8 has a null pointer dereference vulnerability allowing unauthenticated remote attackers to crash worker processes by sending a malformed HTTP request line with an invalid version string. HttpParser::execute() fails to allocate the Url object, and buildResponse() dereferences the NULL pointer without checking the valid_requ flag, causing SIGSEGV and permanent server shutdown after repeating on all workers.
Original NVD description (English source)
TinyWeb through 0.0.8 contains a memory leak vulnerability that allows unauthenticated attackers to exhaust available memory by sending ordinary well-formed HTTP requests. Each request causes HttpParser::execute() to allocate Url objects, HttpHeaders objects, and HttpHeader instances via raw new expressions that are never freed due to missing destructors and unreachable delete calls, causing worker resident memory to grow monotonically by approximately 20 to 28 kB per request until the worker process is killed.