TinyWeb 0.0.8 Memory Leak DoS via HTTP Request Handling
41Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 8.7epss 0.4%
from disclosure to weapon0 days
Published on NVDJul 28
1st PoCJul 26
exploitation probability
0.4%top 71% of all CVEs
observed exploitation
nono source reports it
2 public exploit(s)
TinyWeb through 0.0.8 contains a memory leak vulnerability that allows unauthenticated attackers to exhaust available memory by sending ordinary well-formed HTTP requests. Each request causes HttpParser::execute() to allocate Url objects, HttpHeaders objects, and HttpHeader instances via raw new expressions that are never freed due to missing destructors and unreachable delete calls, causing worker resident memory to grow monotonically by approximately 20 to 28 kB per request until the worker process is killed.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected products
GeneralSandman · TinyWebpublic PoCs found — 2
githubgithub.com/theopaid/CVE-2026-67183-Unauthenticated-Memory-Leak-Leads-To-Memory-Exhaustion-TinyWeb-★ 0cve_referencegithub.com/theopaid/Unauthenticated-Memory-Leak-Leads-To-Memory-Exhaustion-TinyWeb-unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.