CVE-2026-67184
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
TinyWeb through version 0.0.8 has a null pointer dereference vulnerability allowing unauthenticated remote attackers to crash worker processes by sending a malformed HTTP request line with an invalid version string. HttpParser::execute() fails to allocate the Url object, and buildResponse() dereferences the NULL pointer without checking the valid_requ flag, causing SIGSEGV and permanent server shutdown after repeating on all workers.
Risk Assessment
An attacker can cause permanent server denial of service (DoS), making the service unavailable and requiring manual restart, leading to significant downtime.
Recommendation
Upgrade TinyWeb to a version above 0.0.8 that includes version validation and error handling for allocation failures.
Other vulnerabilities in TinyWeb
See all- CVE-2026-22781Critical
TinyWeb HTTP Server before version 1.98 is vulnerable to OS command injection via CGI ISINDEX-style query parameters. The parameters are passed as command-line arguments to the CGI executable via Windows CreateProcess(). An unauthenticated remote attacker can execute arbitrary commands on the server by injecting Windows shell metacharacters into HTTP requests. This vulnerability is fixed in 1.98.
- CVE-2026-67185High
TinyWeb through version 0.0.8 has a path traversal vulnerability allowing unauthenticated attackers to read arbitrary files by submitting ../ sequences in the URL path. The path is concatenated without normalization, dot-segment removal, or boundary checks. Attackers can expose sensitive files like credential stores and private keys when the server runs as root.
- CVE-2026-67183High
TinyWeb through version 0.0.8 has a memory leak vulnerability allowing unauthenticated attackers to exhaust available memory by sending ordinary well-formed HTTP requests. Each request allocates Url, HttpHeaders, and HttpHeader objects via raw new expressions that are never freed due to missing destructors and unreachable delete calls, causing worker memory to grow by ~20-28 kB per request until the process is killed.
Original NVD description (English source)
TinyWeb through 0.0.8 contains a null pointer dereference vulnerability that allows unauthenticated remote attackers to crash worker processes by sending a malformed HTTP request line with an invalid version string. The HttpParser::execute() function fails to allocate the Url object when version parsing fails, leaving the url pointer NULL, and buildResponse() subsequently dereferences this NULL pointer without checking the valid_requ flag, producing a SIGSEGV that terminates the worker process and, when repeated across all workers, takes the server permanently offline until manually restarted.