{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/tinyweb-0.0.8/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-67183"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["TinyWeb 0.0.8"],"_cs_severities":["low"],"_cs_tags":["memory-leak","denial-of-service","webserver"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eA critical memory leak vulnerability, identified as CVE-2026-67183, affects TinyWeb versions up to and including 0.0.8, allowing unauthenticated attackers to trigger a denial of service. The vulnerability stems from the \u003ccode\u003eHttpParser::execute()\u003c/code\u003e function, which, when processing ordinary, well-formed HTTP requests, repeatedly allocates memory for \u003ccode\u003eUrl\u003c/code\u003e, \u003ccode\u003eHttpHeaders\u003c/code\u003e, and \u003ccode\u003eHttpHeader\u003c/code\u003e objects. These memory allocations are never freed due to missing destructors and unreachable \u003ccode\u003edelete\u003c/code\u003e calls within the application's codebase. Consequently, each incoming request causes the web server's worker resident memory to increase monotonically by approximately 20 to 28 kilobytes. This continuous memory consumption, driven by unauthenticated HTTP requests, ultimately exhausts the available system resources, leading to the termination of the worker process and a resulting denial of service for legitimate users. This vulnerability allows for straightforward exploitation with common web requests.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn unauthenticated attacker identifies a vulnerable TinyWeb server (version 0.0.8 or earlier) accessible over HTTP.\u003c/li\u003e\n\u003cli\u003eThe attacker sends an ordinary, well-formed HTTP request to the vulnerable TinyWeb server.\u003c/li\u003e\n\u003cli\u003eThe server's \u003ccode\u003eHttpParser::execute()\u003c/code\u003e function is invoked to process the incoming request.\u003c/li\u003e\n\u003cli\u003eDuring request parsing, the \u003ccode\u003eHttpParser::execute()\u003c/code\u003e function allocates new \u003ccode\u003eUrl\u003c/code\u003e objects, \u003ccode\u003eHttpHeaders\u003c/code\u003e objects, and \u003ccode\u003eHttpHeader\u003c/code\u003e instances using raw \u003ccode\u003enew\u003c/code\u003e expressions.\u003c/li\u003e\n\u003cli\u003eDue to missing destructors and unreachable \u003ccode\u003edelete\u003c/code\u003e calls in the TinyWeb codebase, the memory allocated for these objects is never freed after processing the request.\u003c/li\u003e\n\u003cli\u003eThe attacker continuously sends multiple ordinary, well-formed HTTP requests to the server.\u003c/li\u003e\n\u003cli\u003eEach subsequent request causes the web server's worker process resident memory to grow monotonically by approximately 20 to 28 kB.\u003c/li\u003e\n\u003cli\u003eAs the memory consumption increases, the worker process eventually exhausts all available memory resources, leading to its termination and rendering the TinyWeb server unresponsive.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe successful exploitation of CVE-2026-67183 leads to a denial of service (DoS) condition on the affected TinyWeb server. Unauthenticated attackers can continuously send HTTP requests, causing the server's memory to be consumed until the worker process crashes. This results in the TinyWeb server becoming unresponsive and unavailable to legitimate users, disrupting web services hosted on it. There is no information regarding specific victim counts or targeted sectors, but any organization utilizing vulnerable TinyWeb versions is susceptible to service interruption and potential data loss if the server crashes unexpectedly.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch CVE-2026-67183 by upgrading TinyWeb to a patched version (newer than 0.0.8) immediately.\u003c/li\u003e\n\u003cli\u003eMonitor webserver logs for unusually high rates of HTTP requests from single IP addresses, which could indicate an attempted denial-of-service attack.\u003c/li\u003e\n\u003cli\u003eImplement host-based monitoring to track the memory utilization of TinyWeb worker processes and alert on anomalous, continuous memory growth.\u003c/li\u003e\n\u003cli\u003eConfigure system monitoring to alert on frequent crashes or restarts of the TinyWeb server process.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-28T17:21:31Z","date_published":"2026-07-28T17:21:31Z","id":"https://feed.craftedsignal.io/briefs/2026-07-tinyweb-memory-leak/","summary":"A critical memory leak vulnerability, CVE-2026-67183, in TinyWeb versions up to 0.0.8 allows unauthenticated attackers to exhaust server memory by sending ordinary HTTP requests, leading to worker process termination and denial of service.","title":"TinyWeb Memory Leak Vulnerability (CVE-2026-67183) Leads to Denial of Service","url":"https://feed.craftedsignal.io/briefs/2026-07-tinyweb-memory-leak/"}],"language":"en","title":"CraftedSignal Threat Feed - TinyWeb 0.0.8","version":"https://jsonfeed.org/version/1.1"}