CVE-2026-67183
TinyWeb 0.0.8 Memory Leak DoS via HTTP Request Handling
- State
- Published
- Severity
- 8.7 High
- Published
- Jul 28, 2026
- Updated
- Jul 28, 2026
- Reserved
- Jul 28, 2026
Description
TinyWeb through 0.0.8 contains a memory leak vulnerability that allows unauthenticated attackers to exhaust available memory by sending ordinary well-formed HTTP requests. Each request causes HttpParser::execute() to allocate Url objects, HttpHeaders objects, and HttpHeader instances via raw new expressions that are never freed due to missing destructors and unreachable delete calls, causing worker resident memory to grow monotonically by approximately 20 to 28 kB per request until the worker process is killed.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | VulnCheck |
Weaknesses
- CWE-401 Missing Release of Memory after Effective Lifetime
Affected Products
| Product | Versions |
|---|---|
TinyWebGeneralSandman |
|
References
- Researcher Disclosuretechnical-descriptionexploit
- https://www.vulncheck.com/advisories/tinyweb-memory-leak-dos-via-http-request-handlingthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.