CVE-2026-67184

Name of the Vulnerable Software and Affected Versions TinyWeb versions 0.0.1 through 0.0.8

Description An unauthenticated remote attacker can crash worker processes by sending a malformed HTTP request line containing an invalid version string. The HttpParser::execute() function fails to allocate the Url object when version parsing fails, leaving the url pointer as NULL. Subsequently, the buildResponse() function dereferences this NULL pointer without verifying the valid requ flag, resulting in a SIGSEGV (a segmentation fault that occurs when a program attempts to access a memory location it is not allowed to). If this action is repeated across all worker processes, the server remains offline until a manual restart is performed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.