PatchTheCVECVE-2026-67183: TinyWeb through 0.0.8 contains a memory leak vulnerability that allows unauthenticated attackers to exhaust av
CVE-2026-67183 is a high-severity flaw (CVSS 7.5) affecting affected software. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
TinyWeb through 0.0.8 contains a memory leak vulnerability that allows unauthenticated attackers to exhaust available memory by sending ordinary well-formed HTTP requests. Each request causes HttpParser::execute() to allocate Url objects, HttpHeaders objects, and HttpHeader instances via raw new expressions that are never freed due to missing destructors and unreachable delete calls, causing worker resident memory to grow monotonically by approxi
Why this priority
- High severity
- CISA SSVC: public proof of concept
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 7.5 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.5% (top 57%) |
| CISA exploited list | No |
| Weakness | CWE-401 |
| Published | 2026-07-28 |
| Last modified | 2026-10-23 |
Timeline
- Published CVE record published
- Updated Record last modified
Exact fixes by distribution
Public exploits and detection
Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.
- GitHub PoC: theopaid/CVE-2026-67183-Unauthenticated-Memory-Leak-Leads-To-Memory-Exhaustion-TinyWeb- (0 stars)
- Write-up: github.com/theopaid/Unauthenticated-Memory-Leak-Leads-To-Memory-Exhaustion-TinyWeb-
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.