CVE-2026-67183-Unauthenticated-Memory-Leak-Leads-To-Memory-Exhaustion-TinyWeb-

보안 권고: 인증되지 않은 메모리 누수로 인한 메모리 고갈 TinyWeb 할당된 CVE ID: CVE-2026-67183 요약 TinyWeb는 각 요청을 파싱하는 동안 여러 객체를 할당하고 해제하지 않습니다. 요청 및 헤더 구조체에는 소멸자가 없으며, 응답이 전송된 후 이들을 삭제하는 코드도 없습니다. 워커 메모리는 모든 요청마다 증가하고 절대 줄어들지 않으므로, 지속적인 일반 요청 흐름은 워커를 메모리 고갈 상태로 만듭니다. 영향받는 소프트웨어 프로젝트: TinyWeb...

jetty-line-check

jetty-line-check Which of these six 2026 CVEs has your Jetty or the Jetty pulled in by Spring Boot been hit by — and does the version the official guidance tells you to upgrade to actually exist on Maven Central? The headline is CVE-2026-2332 GHSA-355h-qmc2-wpwf, high / CVSS v3 7.4: chunked reque...

HTTP Request Smuggling

Overview org.eclipse.jetty:jetty-http is an is a http module for jetty server. Affected versions of this package are vulnerable to HTTP Request Smuggling in the chunked request parsing of HttpParser, which accepts a lone LF, rather than CRLF, as the line terminator for chunk extensions, chunk dat...

CVE-2026-67183

TinyWeb through 0.0.8 contains a memory leak vulnerability that allows unauthenticated attackers to exhaust available memory by sending ordinary well-formed HTTP requests. Each request causes HttpParser::execute to allocate Url objects, HttpHeaders objects, and HttpHeader instances via raw new...

EUVD-2026-49902

TinyWeb through 0.0.8 contains a null pointer dereference vulnerability that allows unauthenticated remote attackers to crash worker processes by sending a malformed HTTP request line with an invalid version string. The HttpParser::execute function fails to allocate the Url object when version...

CVE-2026-67184 TinyWeb 0.0.8 Null Pointer Dereference DoS via Malformed HTTP Request

TinyWeb through 0.0.8 contains a null pointer dereference vulnerability that allows unauthenticated remote attackers to crash worker processes by sending a malformed HTTP request line with an invalid version string. The HttpParser::execute function fails to allocate the Url object when version...

CVE-2026-67183 TinyWeb 0.0.8 Memory Leak DoS via HTTP Request Handling

TinyWeb through 0.0.8 contains a memory leak vulnerability that allows unauthenticated attackers to exhaust available memory by sending ordinary well-formed HTTP requests. Each request causes HttpParser::execute to allocate Url objects, HttpHeaders objects, and HttpHeader instances via raw new...

CVE-2026-67184: NULL Pointer Dereference

TinyWeb through 0.0.8 contains a null pointer dereference vulnerability that allows unauthenticated remote attackers to crash worker processes by sending a malformed HTTP request line with an invalid version string. The HttpParser::execute function fails to allocate the Url object when version...

CVE-2026-67183: Missing Release of Memory after Effective Lifetime

TinyWeb through 0.0.8 contains a memory leak vulnerability that allows unauthenticated attackers to exhaust available memory by sending ordinary well-formed HTTP requests. Each request causes HttpParser::execute to allocate Url objects, HttpHeaders objects, and HttpHeader instances via raw new...

uwebsockets:EpollEchoServer: Heap-use-after-free in uWS::HttpParser::consumePostPadded

Project: https://github.com/uNetworking/uWebSockets.git Detailed Report: https://oss-fuzz.com/testcase?key=5573705863397376 Project: uwebsockets Fuzzing Engine: libFuzzer Fuzz Target: EpollEchoServer Job Type: libfuzzerasanuwebsockets Platform Id: linux Crash Type: Heap-use-after-free WRITE 1 Cra...

OSV-2021-453 UNKNOWN WRITE in std::__1::pair<unsigned int, void*> uWS::HttpParser::fenceAndConsumePostPadded<0

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31457 Crash type: UNKNOWN WRITE Crash state: std::1::pair uWS::HttpParser::fenceAndConsumePostPadded0 uWS::HttpParser::consumePostPadded std::1::function::funcLLVMFuzzerTestOneInput::$0, std::1::allocatorLL...

PT-2021-28124

Name of the Vulnerable Software and Affected Versions uWS affected versions not specified Description The issue is related to a crash in the uWS HttpParser, specifically in the fenceAndConsumePostPadded and consumePostPadded functions. The crash type is reported as UNKNOWN WRITE. No information i...

uwebsockets:HttpWithProxy: Crash in std::__1::pair<unsigned int, void*> uWS::HttpParser::fenceAndConsumePostPadded<0

Project: https://github.com/uNetworking/uWebSockets.git Detailed Report: https://oss-fuzz.com/testcase?key=5160530512838656 Project: uwebsockets Fuzzing Engine: afl Fuzz Target: HttpWithProxy Job Type: aflasanuwebsockets Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x7fd1a01878a8...

OSV-2020-2217 Heap-buffer-overflow in std::__1::pair<int, void*> uWS::HttpParser::fenceAndConsumePostPadded<0>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28143 Crash type: Heap-buffer-overflow READ Crash state: std::1::pair uWS::HttpParser::fenceAndConsumePostPadded uWS::HttpParser::consumePostPadded uWS::HttpContext::init...

PT-2020-22162

Name of the Vulnerable Software and Affected Versions uWS affected versions not specified Description A heap-buffer-overflow read issue has been identified. The crash occurs in the uWS::HttpParser component, specifically in the fenceAndConsumePostPadded and consumePostPadded functions, which are...

PT-2020-22164

Name of the Vulnerable Software and Affected Versions uWS affected versions not specified Description The issue is related to a crash in the uWS HttpParser, specifically in the fenceAndConsumePostPadded and consumePostPadded functions. The crash type is reported as UNKNOWN READ. No information is...

uwebsockets:HttpWithProxy: Crash in std::__1::pair<unsigned int, void*> uWS::HttpParser::fenceAndConsumePostPadded<0

Project: https://github.com/uNetworking/uWebSockets.git Detailed Report: https://oss-fuzz.com/testcase?key=5091297987788800 Project: uwebsockets Fuzzing Engine: libFuzzer Fuzz Target: HttpWithProxy Job Type: libfuzzerasanuwebsockets Platform Id: linux Crash Type: UNKNOWN READ Crash Address:...

uwebsockets:EpollHelloWorld: Heap-buffer-overflow in std::__1::pair<int, void*> uWS::HttpParser::fenceAndConsumePostPadded<0>

Project: https://github.com/uNetworking/uWebSockets.git Detailed Report: https://oss-fuzz.com/testcase?key=4667257845972992 Project: uwebsockets Fuzzing Engine: libFuzzer Fuzz Target: EpollHelloWorld Job Type: libfuzzerasanuwebsockets Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash...

Jetty HttpParser Error Remote Memory Disclosure

The remote instance of Jetty is affected by a remote memory disclosure vulnerability in the HttpParser module due to incorrect handling of illegal characters in header values. When an illegal character is encountered in an HTTP request, Jetty writes a response in a shared buffer that was used in ...