Vulnerability in Generalsandman Tinyweb
CVE-2026-67183
TinyWeb through 0.0.8 contains a memory leak vulnerability that allows unauthenticated attackers to exhaust available memory by sending ordinary well-formed HTTP requests. Each request causes HttpParser::execute() to allocate Url objects, HttpHeaders objects, and HttpHeader instances via raw new expressions that are never freed due to missing destructors and unreachable delete calls, causing worker resident memory to grow monotonically by approximately 20 to 28 kB per request until the worker process is killed.
EPSS: 0.004 (30.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Generalsandman Tinyweb — versions e48f15d38d2bebeec9cabcfdde81931b10a1963b, 0.0.8
Weakness classification (CWE)
Public proof-of-concept exploits
References
- disclosure@vulncheck.com (technical-description, exploit)
- disclosure@vulncheck.com (third-party-advisory)
Frequently asked questions
- What is CVE-2026-67183?
- CVE-2026-67183 is a high-severity vulnerability in Generalsandman Tinyweb, classified under Missing Release of Memory after Effective Lifetime. CVSS score: 7.5/10. Published 2026-07-28.
- How severe is CVE-2026-67183?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2026-67183 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.