CVE-2026-67183 TinyWeb 0.0.8 Memory Leak DoS via HTTP Request Handling
Unauthenticated attackers can exhaust memory and crash the TinyWeb server by sending standard HTTP requests due to improper resource management.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-67183?
CVE-2026-67183 is a high-severity denial of service vulnerability in GeneralSandman TinyWeb, published on 28 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
TinyWeb through 0.0.8 contains a memory leak vulnerability that allows unauthenticated attackers to exhaust available memory by sending ordinary well-formed HTTP requests. Each request causes HttpParser::execute() to allocate Url objects, HttpHeaders objects, and HttpHeader instances via raw new expressions that are never freed due to missing destructors and unreachable delete calls, causing worker resident memory to grow monotonically by approximately 20 to 28 kB per request until the worker process is killed.
Weakness: CWE-401
Which versions are affected by CVE-2026-67183?
How do I fix CVE-2026-67183?
No fix has been published for CVE-2026-67183 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-67183 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-67183 exists.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-9hxr-3mx5-3v44.