PT-2026-65543 · Generalsandman · Tinyweb

Theodosis Paidakis · CVE-2026-67183 · Publicado 2026-07-28 · Atualizado 2026-07-28

NVD

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

TinyWeb through 0.0.8 contains a memory leak vulnerability that allows unauthenticated attackers to exhaust available memory by sending ordinary well-formed HTTP requests. Each request causes HttpParser::execute() to allocate Url objects, HttpHeaders objects, and HttpHeader instances via raw new expressions that are never freed due to missing destructors and unreachable delete calls, causing worker resident memory to grow monotonically by approximately 20 to 28 kB per request until the worker process is killed.

Exploit

Correção

Memory Leak

Enumeração de Fraquezas

CWE-401

Identificadores relacionados

CVE-2026-67183

Produtos afetados

Tinyweb

Referências · 3

• 🔥 https://github.com/theopaid/Unauthenticated-Memory-Leak-Leads-To-Memory-Exhaustion-TinyWeb- · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-67183 · Nota de Segurança
• https://vulncheck.com/advisories/tinyweb-memory-leak-dos-via-http-request-handling · Nota