TinyWeb 0.0.8 Memory Leak DoS via HTTP Request Handling
41Vexday Risk Score
Sin señal de explotación. Ella tiene prueba de concepto pública.
ssvc Attendcvss 8.7epss 0.4%
de la publicación al arma0 días
Publicada en NVD28 jul
1ª PoC26 jul
probabilidad de explotación
0.4%top 71% de las CVE
explotación observada
noninguna fuente lo reporta
2 exploit(s) público(s)
TinyWeb through 0.0.8 contains a memory leak vulnerability that allows unauthenticated attackers to exhaust available memory by sending ordinary well-formed HTTP requests. Each request causes HttpParser::execute() to allocate Url objects, HttpHeaders objects, and HttpHeader instances via raw new expressions that are never freed due to missing destructors and unreachable delete calls, causing worker resident memory to grow monotonically by approximately 20 to 28 kB per request until the worker process is killed.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Productos afectados
GeneralSandman · TinyWebPoCs públicas encontradas — 2
githubgithub.com/theopaid/CVE-2026-67183-Unauthenticated-Memory-Leak-Leads-To-Memory-Exhaustion-TinyWeb-★ 0cve_referencegithub.com/theopaid/Unauthenticated-Memory-Leak-Leads-To-Memory-Exhaustion-TinyWeb-no verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.