Is CVE-2026-67183 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-67183 being exploited in the wild.

How severe is CVE-2026-67183?

High severity, with a CVSS score of 7.5, published 28 July 2026.

Which products and versions are affected?

GeneralSandman TinyWeb 0.0.8 and earlier.

Is there a fix for CVE-2026-67183?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-67183 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-67183?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-67183: GeneralSandman TinyWeb memory leak in HTTP request handling

CVE-2026-67183 · Severity: high · CVSS 7.5 · Published 2026-07-28

TinyWeb, a lightweight web server, contains a flaw in how it handles incoming web requests. Every time the server receives a request, it fails to release the memory used to process that request, causing the server's memory usage to grow indefinitely. An unauthenticated attacker can exploit this by sending a large number of standard web requests, eventually causing the server to crash or become unresponsive due to memory exhaustion.

Quick answers

Is CVE-2026-67183 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-67183 being exploited in the wild.
How severe is CVE-2026-67183?: High severity, with a CVSS score of 7.5, published 28 July 2026.
Which products and versions are affected?: GeneralSandman TinyWeb 0.0.8 and earlier.
Is there a fix for CVE-2026-67183?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-67183 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-67183?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A memory leak (CWE-401) exists in TinyWeb through version 0.0.8 within the HttpParser::execute() function. The parser allocates Url, HttpHeaders, and HttpHeader objects using raw 'new' expressions, but the HttpRequest and HttpHeaders structures lack destructors to free these pointers. Additionally, the code contains unreachable 'delete' calls, preventing the release of memory after a response is sent. An unauthenticated remote attacker can trigger this leak by sending standard HTTP requests; each request leaks approximately 20 to 28 kB of memory. This monotonic growth continues until the worker process is terminated by the operating system's out-of-memory (OOM) killer. No patch is currently available.

Affected products

GeneralSandman TinyWeb 0.0.8 and earlier

Timeline

2026-07-28: disclosed: Vulnerability disclosed by researcher Theodosis Paidakis
2026-07-28: advisory: CVE-2026-67183 published by NVD and VulnCheck

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.