Executive brief
TinyWeb, a lightweight web server, contains a flaw in how it handles incoming web requests. Every time the server receives a request, it fails to release the memory used to process that request, causing the server's memory usage to grow indefinitely. An unauthenticated attacker can exploit this by sending a large number of standard web requests, eventually causing the server to crash or become unresponsive due to memory exhaustion.
Technical details
A memory leak (CWE-401) exists in TinyWeb through version 0.0.8 within the HttpParser::execute() function. The parser allocates Url, HttpHeaders, and HttpHeader objects using raw 'new' expressions, but the HttpRequest and HttpHeaders structures lack destructors to free these pointers. Additionally, the code contains unreachable 'delete' calls, preventing the release of memory after a response is sent. An unauthenticated remote attacker can trigger this leak by sending standard HTTP requests; each request leaks approximately 20 to 28 kB of memory. This monotonic growth continues until the worker process is terminated by the operating system's out-of-memory (OOM) killer. No patch is currently available.
Affected products
- GeneralSandman TinyWeb 0.0.8 and earlier
Timeline
- 2026-07-28: disclosed: Vulnerability disclosed by researcher Theodosis Paidakis
- 2026-07-28: advisory: CVE-2026-67183 published by NVD and VulnCheck