CVE-2026-67183-Unauthenticated-Memory-Leak-Leads-To-Memory-Exhaustion-TinyWeb-

Aviso de seguridad: Una fuga de memoria sin autenticación provoca el agotamiento de la memoria TinyWeb Identificador CVE asignado: CVE-2026-67183 Resumen TinyWeb asigna varios objetos al analizar cada solicitud y nunca los libera. Las estructuras de solicitud y de cabeceras no tienen destructores...

jetty-line-check

jetty-line-check 你这套 Jetty或 Spring Boot 带进来的 Jetty,中了 2026 年这六条 CVE 的哪几条 —— 而官方叫你升的那一版,在 Maven Central 上到底存不存在? 主打 CVE-2026-2332GHSA-355h-qmc2-wpwf,high / CVSS v3 7.4:jetty-http 的 chunked 请求走私。 2026-09-17 官方又发了同族的 CVE-2026-19203LF EXT.TERM 走私,high / CVSS v4 8.3:它的 9.4 线覆盖到 9.4.63 , 官方叫你升 9.4.64 —...

HTTP Request Smuggling

Overview org.eclipse.jetty:jetty-http is an is a http module for jetty server. Affected versions of this package are vulnerable to HTTP Request Smuggling in the chunked request parsing of HttpParser, which accepts a lone LF, rather than CRLF, as the line terminator for chunk extensions, chunk dat...

CVE-2026-67183

TinyWeb through 0.0.8 contains a memory leak vulnerability that allows unauthenticated attackers to exhaust available memory by sending ordinary well-formed HTTP requests. Each request causes HttpParser::execute to allocate Url objects, HttpHeaders objects, and HttpHeader instances via raw new...

EUVD-2026-49902

TinyWeb through 0.0.8 contains a null pointer dereference vulnerability that allows unauthenticated remote attackers to crash worker processes by sending a malformed HTTP request line with an invalid version string. The HttpParser::execute function fails to allocate the Url object when version...

CVE-2026-67183: Missing Release of Memory after Effective Lifetime

TinyWeb through 0.0.8 contains a memory leak vulnerability that allows unauthenticated attackers to exhaust available memory by sending ordinary well-formed HTTP requests. Each request causes HttpParser::execute to allocate Url objects, HttpHeaders objects, and HttpHeader instances via raw new...

CVE-2026-67184: NULL Pointer Dereference

TinyWeb through 0.0.8 contains a null pointer dereference vulnerability that allows unauthenticated remote attackers to crash worker processes by sending a malformed HTTP request line with an invalid version string. The HttpParser::execute function fails to allocate the Url object when version...

OSV-2021-453 UNKNOWN WRITE in std::__1::pair<unsigned int, void*> uWS::HttpParser::fenceAndConsumePostPadded<0

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31457 Crash type: UNKNOWN WRITE Crash state: std::1::pair uWS::HttpParser::fenceAndConsumePostPadded0 uWS::HttpParser::consumePostPadded std::1::function::funcLLVMFuzzerTestOneInput::$0, std::1::allocatorLL...

OSV-2020-2217 Heap-buffer-overflow in std::__1::pair<int, void*> uWS::HttpParser::fenceAndConsumePostPadded<0>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28143 Crash type: Heap-buffer-overflow READ Crash state: std::1::pair uWS::HttpParser::fenceAndConsumePostPadded uWS::HttpParser::consumePostPadded uWS::HttpContext::init...

Jetty HttpParser Error Remote Memory Disclosure

The remote instance of Jetty is affected by a remote memory disclosure vulnerability in the HttpParser module due to incorrect handling of illegal characters in header values. When an illegal character is encountered in an HTTP request, Jetty writes a response in a shared buffer that was used in ...