CVE-2026-67183-Unauthenticated-Memory-Leak-Leads-To-Memory-Exhaustion-TinyWeb-

Security Advisory: Unauthenticated Memory Leak Leads To Memory Exhaustion TinyWeb Assigned CVE ID: CVE-2026-67183 Summary TinyWeb allocates several objects while parsing each request and never frees them. The request and header structures have no destructors, and nothing deletes them after the...

jetty-line-check

jetty-line-check Which of these six 2026 CVEs has your Jetty or the Jetty pulled in by Spring Boot been hit by — and does the version the official guidance tells you to upgrade to actually exist on Maven Central? The headline is CVE-2026-2332 GHSA-355h-qmc2-wpwf, high / CVSS v3 7.4: chunked reque...

HTTP Request Smuggling

Overview org.eclipse.jetty:jetty-http is an is a http module for jetty server. Affected versions of this package are vulnerable to HTTP Request Smuggling in the chunked request parsing of HttpParser, which accepts a lone LF, rather than CRLF, as the line terminator for chunk extensions, chunk dat...

CVE-2026-67183

TinyWeb through 0.0.8 contains a memory leak vulnerability that allows unauthenticated attackers to exhaust available memory by sending ordinary well-formed HTTP requests. Each request causes HttpParser::execute to allocate Url objects, HttpHeaders objects, and HttpHeader instances via raw new...

EUVD-2026-49902

TinyWeb through 0.0.8 contains a null pointer dereference vulnerability that allows unauthenticated remote attackers to crash worker processes by sending a malformed HTTP request line with an invalid version string. The HttpParser::execute function fails to allocate the Url object when version...

CVE-2026-67184

TinyWeb through 0.0.8 contains a null pointer dereference vulnerability that allows unauthenticated remote attackers to crash worker processes by sending a malformed HTTP request line with an invalid version string. The HttpParser::execute function fails to allocate the Url object when version...

CVE-2026-67184 TinyWeb 0.0.8 Null Pointer Dereference DoS via Malformed HTTP Request

TinyWeb through 0.0.8 contains a null pointer dereference vulnerability that allows unauthenticated remote attackers to crash worker processes by sending a malformed HTTP request line with an invalid version string. The HttpParser::execute function fails to allocate the Url object when version...

CVE-2026-67183

TinyWeb through 0.0.8 contains a memory leak vulnerability that allows unauthenticated attackers to exhaust available memory by sending ordinary well-formed HTTP requests. Each request causes HttpParser::execute to allocate Url objects, HttpHeaders objects, and HttpHeader instances via raw new...

CVE-2026-67183 TinyWeb 0.0.8 Memory Leak DoS via HTTP Request Handling

TinyWeb through 0.0.8 contains a memory leak vulnerability that allows unauthenticated attackers to exhaust available memory by sending ordinary well-formed HTTP requests. Each request causes HttpParser::execute to allocate Url objects, HttpHeaders objects, and HttpHeader instances via raw new...

CVE-2026-67184: NULL Pointer Dereference

TinyWeb through 0.0.8 contains a null pointer dereference vulnerability that allows unauthenticated remote attackers to crash worker processes by sending a malformed HTTP request line with an invalid version string. The HttpParser::execute function fails to allocate the Url object when version...

CVE-2026-67183: Missing Release of Memory after Effective Lifetime

TinyWeb through 0.0.8 contains a memory leak vulnerability that allows unauthenticated attackers to exhaust available memory by sending ordinary well-formed HTTP requests. Each request causes HttpParser::execute to allocate Url objects, HttpHeaders objects, and HttpHeader instances via raw new...

uwebsockets:EpollEchoServer: Heap-use-after-free in uWS::HttpParser::consumePostPadded

Project: https://github.com/uNetworking/uWebSockets.git Detailed Report: https://oss-fuzz.com/testcase?key=5573705863397376 Project: uwebsockets Fuzzing Engine: libFuzzer Fuzz Target: EpollEchoServer Job Type: libfuzzerasanuwebsockets Platform Id: linux Crash Type: Heap-use-after-free WRITE 1 Cra...

OSV-2021-453 UNKNOWN WRITE in std::__1::pair<unsigned int, void*> uWS::HttpParser::fenceAndConsumePostPadded<0

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31457 Crash type: UNKNOWN WRITE Crash state: std::1::pair uWS::HttpParser::fenceAndConsumePostPadded0 uWS::HttpParser::consumePostPadded std::1::function::funcLLVMFuzzerTestOneInput::$0, std::1::allocatorLL...

PT-2021-28124

Name of the Vulnerable Software and Affected Versions uWS affected versions not specified Description The issue is related to a crash in the uWS HttpParser, specifically in the fenceAndConsumePostPadded and consumePostPadded functions. The crash type is reported as UNKNOWN WRITE. No information i...

uwebsockets:HttpWithProxy: Crash in std::__1::pair<unsigned int, void*> uWS::HttpParser::fenceAndConsumePostPadded<0

Project: https://github.com/uNetworking/uWebSockets.git Detailed Report: https://oss-fuzz.com/testcase?key=5160530512838656 Project: uwebsockets Fuzzing Engine: afl Fuzz Target: HttpWithProxy Job Type: aflasanuwebsockets Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x7fd1a01878a8...

OSV-2020-2217 Heap-buffer-overflow in std::__1::pair<int, void*> uWS::HttpParser::fenceAndConsumePostPadded<0>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28143 Crash type: Heap-buffer-overflow READ Crash state: std::1::pair uWS::HttpParser::fenceAndConsumePostPadded uWS::HttpParser::consumePostPadded uWS::HttpContext::init...

PT-2020-22162

Name of the Vulnerable Software and Affected Versions uWS affected versions not specified Description A heap-buffer-overflow read issue has been identified. The crash occurs in the uWS::HttpParser component, specifically in the fenceAndConsumePostPadded and consumePostPadded functions, which are...

PT-2020-22164

Name of the Vulnerable Software and Affected Versions uWS affected versions not specified Description The issue is related to a crash in the uWS HttpParser, specifically in the fenceAndConsumePostPadded and consumePostPadded functions. The crash type is reported as UNKNOWN READ. No information is...

uwebsockets:HttpWithProxy: Crash in std::__1::pair<unsigned int, void*> uWS::HttpParser::fenceAndConsumePostPadded<0

Project: https://github.com/uNetworking/uWebSockets.git Detailed Report: https://oss-fuzz.com/testcase?key=5091297987788800 Project: uwebsockets Fuzzing Engine: libFuzzer Fuzz Target: HttpWithProxy Job Type: libfuzzerasanuwebsockets Platform Id: linux Crash Type: UNKNOWN READ Crash Address:...

uwebsockets:EpollHelloWorld: Heap-buffer-overflow in std::__1::pair<int, void*> uWS::HttpParser::fenceAndConsumePostPadded<0>

Project: https://github.com/uNetworking/uWebSockets.git Detailed Report: https://oss-fuzz.com/testcase?key=4667257845972992 Project: uwebsockets Fuzzing Engine: libFuzzer Fuzz Target: EpollHelloWorld Job Type: libfuzzerasanuwebsockets Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash...