CVE-2026-67184
TinyWeb 0.0.8 Null Pointer Dereference DoS via Malformed HTTP Request
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
TinyWeb through 0.0.8 contains a null pointer dereference vulnerability that allows unauthenticated remote attackers to crash worker processes by sending a malformed HTTP request line with an invalid version string. The HttpParser::execute() function fails to allocate the Url object when version parsing fails, leaving the url pointer NULL, and buildResponse() subsequently dereferences this NULL pointer without checking the valid_requ flag, producing a SIGSEGV that terminates the worker process and, when repeated across all workers, takes the server permanently offline until manually restarted.
| CWE | CWE-476 |
| Vendor | generalsandman |
| Product | tinyweb |
| Published | Jul 28, 2026 |
| Last Updated | Jul 28, 2026 |
Stay Ahead of the Next One
Get instant alerts for generalsandman tinyweb
Be the first to know when new high vulnerabilities affecting generalsandman tinyweb are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Affected Versions
GeneralSandman / TinyWeb
e48f15d38d2bebeec9cabcfdde81931b10a1963b ≤ a381da252fe8e873c8aff22703040426cc9b2ae0 0.0.8
References
Credits
Theodosis Paidakis