CVE-2026-67183

Name of the Vulnerable Software and Affected Versions TinyWeb versions 0.0.1 through 0.0.8

Description Unauthenticated attackers can exhaust available memory by sending standard well-formed HTTP requests. This occurs because the HttpParser::execute() function allocates Url objects, HttpHeaders objects, and HttpHeader instances using raw new expressions that are never freed due to missing destructors and unreachable delete calls. Consequently, worker resident memory increases by approximately 20 to 28 kB per request until the worker process is terminated.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.