Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2026-67184

TinyWeb 0.0.8 Null Pointer Dereference DoS via Malformed HTTP Request

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

TinyWeb through 0.0.8 contains a null pointer dereference vulnerability that allows unauthenticated remote attackers to crash worker processes by sending a malformed HTTP request line with an invalid version string. The HttpParser::execute() function fails to allocate the Url object when version parsing fails, leaving the url pointer NULL, and buildResponse() subsequently dereferences this NULL pointer without checking the valid_requ flag, producing a SIGSEGV that terminates the worker process and, when repeated across all workers, takes the server permanently offline until manually restarted.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

GeneralSandman TinyWeb

Default version status: affected

  • e48f15d38d2bebeec9cabcfdde81931b10a1963b to ≤ a381da252fe8e873c8aff22703040426cc9b2ae0affected
  • 0.0.8affected
pkg:github/GeneralSandman/TinyWeb

References