Description
TinyWeb through 0.0.8 contains a memory leak vulnerability that allows unauthenticated attackers to exhaust available memory by sending ordinary well-formed HTTP requests. Each request causes HttpParser::execute() to allocate Url objects, HttpHeaders objects, and HttpHeader instances via raw new expressions that are never freed due to missing destructors and unreachable delete calls, causing worker resident memory to grow monotonically by approximately 20 to 28 kB per request until the worker process is killed.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| GeneralSandman | TinyWeb | 0.0.8 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
theopaid/CVE-2026-67183-Unauthenticated-Memory-Leak-Leads-To-Memory-Exhaustion-TinyWeb- ★ 0 · Jul 26, 2026
Security Advisory: Unauthenticated Memory Leak Leads To Memory Exhaustion (TinyWeb)
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- Researcher Disclosure technical-description exploit
- https://www.vulncheck.com/advisories/tinyweb-memory-leak-dos-via-http-request-handling third-party-advisory