CVE-2026-67183

TinyWeb through 0.0.8 contains a memory leak vulnerability that allows unauthenticated attackers to exhaust available memory by sending ordinary well-formed HTTP requests. Each request causes HttpParser::execute() to allocate Url objects, HttpHeaders objects, and HttpHeader instances via raw new expressions that are never freed due to missing destructors and unreachable delete calls, causing worker resident memory to grow monotonically by approximately 20 to 28 kB per request until the worker process is killed.

CVSS v4.0

8.7 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.37% chance of exploitation in the next 30 days, 30th percentile

Published

2026-07-28

Proof-of-concept exploits (1)

• theopaid/Unauthenticated-Memory-Leak-Leads-To-Memory-Exhaustion-TinyWeb-0★ · 2026-07-28

References

• CVE Record
• NVD entry

Related

• CVE-2023-27163
• CVE-2026-66729
• CVE-2026-66730
• CVE-2026-66731
• CVE-2026-66746
• CVE-2026-66748