Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2026-67183

TinyWeb 0.0.8 Memory Leak DoS via HTTP Request Handling

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

TinyWeb through 0.0.8 contains a memory leak vulnerability that allows unauthenticated attackers to exhaust available memory by sending ordinary well-formed HTTP requests. Each request causes HttpParser::execute() to allocate Url objects, HttpHeaders objects, and HttpHeader instances via raw new expressions that are never freed due to missing destructors and unreachable delete calls, causing worker resident memory to grow monotonically by approximately 20 to 28 kB per request until the worker process is killed.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

GeneralSandman TinyWeb

Default version status: affected

  • e48f15d38d2bebeec9cabcfdde81931b10a1963b to ≤ a381da252fe8e873c8aff22703040426cc9b2ae0affected
  • 0.0.8affected
pkg:github/GeneralSandman/TinyWeb

References