CVE-2026-67183: TinyWeb Memory Leak DOS Vulnerability

CVE-2026-67183 Overview

CVE-2026-67183 is a memory leak vulnerability in TinyWeb through version 0.0.8 that enables unauthenticated remote attackers to exhaust server memory. The flaw resides in HttpParser::execute(), which allocates Url, HttpHeaders, and HttpHeader objects via raw new expressions that are never freed. Missing destructors and unreachable delete calls cause worker resident memory to grow by approximately 20 to 28 kB per request. Attackers require no authentication and can trigger the condition using ordinary well-formed HTTP requests until the worker process is terminated.

Critical Impact
Unauthenticated network attackers can exhaust TinyWeb worker memory by sending well-formed HTTP requests, resulting in denial of service.

Affected Products

TinyWeb through version 0.0.8
All deployments exposing the TinyWeb HTTP listener to untrusted networks
Applications embedding the vulnerable HttpParser component

Discovery Timeline

2026-07-28 - CVE-2026-67183 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-67183

Vulnerability Analysis

The vulnerability is a memory leak [CWE-401] in the TinyWeb HTTP request parser. Each incoming HTTP request causes HttpParser::execute() to allocate parser state objects on the heap. These objects include a Url instance, an HttpHeaders container, and one or more HttpHeader entries. The parser never releases these allocations after the request completes. Repeated requests accumulate roughly 20 to 28 kB of unfreed memory each, driving worker resident set size upward until the operating system terminates the process. Because the trigger is a valid HTTP request, no malformed input or authentication is required.

Root Cause

The root cause is missing memory management in the C++ parser code. Objects allocated with raw new expressions lack matching delete calls on the request completion path. Destructors that would free owned children are either absent or fail to execute because the parent objects themselves are never destroyed. This creates an unbounded allocation pattern on every request.

Attack Vector

Exploitation requires only network reachability to the TinyWeb service. An attacker sends a sustained stream of standard HTTP requests, such as repeated GET / requests with typical headers. Each request permanently retains parser allocations, monotonically growing memory usage. Once memory limits are reached, the worker is killed by the kernel out-of-memory handler or by container limits, producing a denial-of-service condition.

No verified exploit code is republished here. Refer to the GitHub PoC Repository and the VulnCheck Security Advisory for reproduction details.

Detection Methods for CVE-2026-67183

Indicators of Compromise

Monotonic growth of TinyWeb worker resident set size (RSS) without corresponding traffic spikes in response size
Repeated worker process restarts or out-of-memory (OOM) kernel log entries referencing the TinyWeb binary
Sustained inbound HTTP request volume from a small set of source IP addresses targeting the TinyWeb listener

Detection Strategies

Baseline worker memory usage under normal load and alert when RSS grows by approximately 20 to 28 kB per served request
Correlate dmesg OOM-killer events with TinyWeb process identifiers to confirm exhaustion-driven termination
Inspect HTTP access logs for high-volume request patterns from single sources against the TinyWeb endpoint

Monitoring Recommendations

Enable process-level memory telemetry with alerts on unbounded RSS growth for the TinyWeb worker
Forward web server access logs and kernel OOM events to a centralized log platform for correlation
Track request rate per source IP and set thresholds appropriate for the deployed workload

How to Mitigate CVE-2026-67183

Immediate Actions Required

Restrict network access to the TinyWeb listener using firewall rules or reverse proxy allow-lists
Place TinyWeb behind a hardened reverse proxy that enforces per-client request rate limits
Configure process memory limits and automatic restart policies to contain worker exhaustion
Monitor the VulnCheck Security Advisory for a fixed release

Patch Information

At the time of publication, no vendor patch is listed in the NVD entry for CVE-2026-67183. TinyWeb versions through 0.0.8 are affected. Operators should track the GitHub PoC Repository and vendor channels for a fixed build that adds proper delete calls and destructors to HttpParser::execute().

Workarounds

Deploy a rate-limiting reverse proxy such as nginx or HAProxy in front of TinyWeb to cap requests per source
Run TinyWeb under a supervisor (for example, systemd) with a strict MemoryMax limit and automatic restart on failure
Consider migrating to an actively maintained HTTP server for production workloads until a patched release is available

bash

# Example systemd unit hardening to contain memory exhaustion
[Service]
ExecStart=/usr/local/bin/tinyweb
MemoryMax=128M
Restart=on-failure
RestartSec=2s