VULNERABILITY INTELLIGENCE

CVE-2026-67184

CVSS score8.7 HIGH
EPSS probability0.61%
CISA KEVNot currently listed
Published2026-07-28
Last modified2026-10-23
CVSS vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Description

TinyWeb through 0.0.8 contains a null pointer dereference vulnerability that allows unauthenticated remote attackers to crash worker processes by sending a malformed HTTP request line with an invalid version string. The HttpParser::execute() function fails to allocate the Url object when version parsing fails, leaving the url pointer NULL, and buildResponse() subsequently dereferences this NULL pointer without checking the valid_requ flag, producing a SIGSEGV that terminates the worker process and, when repeated across all workers, takes the server permanently offline until manually restarted.

Weakness classification

  • CWE-476: NULL Pointer Dereference

Primary references