Vulnerability details

CVE-2026-67183

GeneralSandman TinyWeb

TinyWeb 0.0.8 Memory Leak DoS via HTTP Request Handling

CVSS 4.0

8.7High

Official description

TinyWeb through 0.0.8 contains a memory leak vulnerability that allows unauthenticated attackers to exhaust available memory by sending ordinary well-formed HTTP requests. Each request causes HttpParser::execute() to allocate Url objects, HttpHeaders objects, and HttpHeader instances via raw new expressions that are never freed due to missing destructors and unreachable delete calls, causing worker resident memory to grow monotonically by approximately 20 to 28 kB per request until the worker process is killed.

CVSS scores

Score	Version	Source	Vector
8.7High	4.0	CVEProject cvelistV5 (CNA) (VulnCheck)	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N`
7.5High	3.1	CVEProject cvelistV5 (CNA) (VulnCheck)	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`

Affected products

Vendor	Product	Versions	Source
GeneralSandman	TinyWeb	0.0.8	CVEProject cvelistV5 (CNA)
GeneralSandman	TinyWeb	e48f15d38d2bebeec9cabcfdde81931b10a1963b ≤ v ≤ a381da252fe8e873c8aff22703040426cc9b2ae0	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/theopaid/Unauthenticated-Memory-Leak-Leads-To-Memory-Exhaustion-TinyWeb- technical-descriptionexploit
https://www.vulncheck.com/advisories/tinyweb-memory-leak-dos-via-http-request-handling third-party-advisory

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-07-28
Last updated: 2026-07-28
State: Published
Assigner (CNA): VulnCheck

Exploit prediction (EPSS)

0.5%

Probability of exploitation in 30 days

43.7%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: Yes
Exploitation: Proof of concept
Technical impact: Partial

Weaknesses (CWE)

CWE-401
Missing Release of Memory after Effective Lifetime