CVE-2026-67183-Unauthenticated-Memory-Leak-Leads-To-Memory-Exhaustion-TinyWeb-

セキュリティアドバイザリ: 未認証のメモリリークによるメモリ枯渇 TinyWeb 割り当て済み CVE ID: CVE-2026-67183 概要 TinyWeb は各リクエストの解析中に複数のオブジェクトを割り当てますが、それらを解放することはありません。リクエスト構造体とヘッダー構造体にはデストラクタがなく、レスポンス送信後にそれらを削除する処理もありません。ワーカーのメモリはリクエストのたびに増加し、決して減少しないため、通常のリクエストを安定して送り続けるだけでワーカーのメモリが枯渇します。 影響を受けるソフトウェア プロジェクト: TinyWeb...

CVE-2026-67185-Unauthenticated-Path-Traversal-Allows-Arbitrary-File-Read-TinyWeb-

セキュリティアドバイザリ: 認証不要のパストラバーサルにより任意のファイルが読み取り可能 TinyWeb 割り当てられたCVE ID: CVE-2026-67185 概要 TinyWebは、配信するファイルのパスを、WebルートとリクエストURLをそのまま結合して構築しており、正規化は行われません。認証を行っていないリモートクライアントは、リクエストラインに../シーケンスを挿入することで、サーバープロセスがオープンできる任意のファイル（Webルート外のファイルを含む）を読み取ることができます。 影響を受けるソフトウェア プロジェクト: TinyWeb...

CVE-2026-67184-Unauthenticated-NULL-Pointer-Dereference-Crashes-the-Server-TinyWeb-

セキュリティアドバイザリ: 未認証の NULL ポインタ参照がサーバをクラッシュさせる TinyWeb 割り当て済み CVE ID: CVE-2026-67184 概要 TinyWeb がリクエストラインのパースに失敗すると、エラーを返しますが、リクエストの URL ポインタを NULL に設定したままにします。呼び出し元はエラーを無視してリクエストをレスポンスビルダーに渡すため、ビルダーがその NULL ポインタを参照してワーカーがクラッシュします。少数の不正なリクエストでサーバ全体がダウンし、復旧しません。 影響を受けるソフトウェア Project: TinyWeb...

CVE-2026-67183

TinyWeb through 0.0.8 contains a memory leak vulnerability that allows unauthenticated attackers to exhaust available memory by sending ordinary well-formed HTTP requests. Each request causes HttpParser::execute to allocate Url objects, HttpHeaders objects, and HttpHeader instances via raw new...

CVE-2026-67184

TinyWeb through 0.0.8 contains a null pointer dereference vulnerability that allows unauthenticated remote attackers to crash worker processes by sending a malformed HTTP request line with an invalid version string. The HttpParser::execute function fails to allocate the Url object when version...

CVE-2026-67185

TinyWeb through 0.0.8 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by submitting ../ sequences in the URL path, which are concatenated directly to the configured web root in HttpBuilder::buildResponse without normalization, dot-segment...

EUVD-2026-49904

TinyWeb through 0.0.8 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by submitting ../ sequences in the URL path, which are concatenated directly to the configured web root in HttpBuilder::buildResponse without normalization, dot-segment...

CVE-2026-67185

CVE-2026-67185 affects TinyWeb up to version 0.0.8 and describes a path traversal in HttpBuilder::buildResponse() that concatenates URL path segments directly to the web root without normalization, allowing unauthenticated attackers to read files via ../ sequences. The vulnerability can expose se...

CVE-2026-67184

Summary: TinyWeb 0.0.8 and earlier are affected by a null pointer dereference due to a failure in HttpParser::execute() when parsing an HTTP request line with an invalid version. The code path leaves Url as NULL and then buildResponse() dereferences it without validating valid_requ, causing a SIG...

CVE-2026-67184

TinyWeb through 0.0.8 contains a null pointer dereference vulnerability that allows unauthenticated remote attackers to crash worker processes by sending a malformed HTTP request line with an invalid version string. The HttpParser::execute function fails to allocate the Url object when version...

EUVD-2026-49902

TinyWeb through 0.0.8 contains a null pointer dereference vulnerability that allows unauthenticated remote attackers to crash worker processes by sending a malformed HTTP request line with an invalid version string. The HttpParser::execute function fails to allocate the Url object when version...

CVE-2026-67184 TinyWeb 0.0.8 Null Pointer Dereference DoS via Malformed HTTP Request

TinyWeb through 0.0.8 contains a null pointer dereference vulnerability that allows unauthenticated remote attackers to crash worker processes by sending a malformed HTTP request line with an invalid version string. The HttpParser::execute function fails to allocate the Url object when version...

CVE-2026-67183

TinyWeb through 0.0.8 contains a memory leak vulnerability that allows unauthenticated attackers to exhaust available memory by sending ordinary well-formed HTTP requests. Each request causes HttpParser::execute to allocate Url objects, HttpHeaders objects, and HttpHeader instances via raw new...

CVE-2026-67183

TinyWeb up to version 0.0.8 is affected by a memory-leak DoS caused by allocations in HttpParser::execute (Url objects, HttpHeaders, and HttpHeader instances) that are never freed due to missing destructors and unreachable deletes. Each authenticated-ill-formed? Actually unauthenticated, per-requ...

CVE-2026-67183 TinyWeb 0.0.8 Memory Leak DoS via HTTP Request Handling

TinyWeb through 0.0.8 contains a memory leak vulnerability that allows unauthenticated attackers to exhaust available memory by sending ordinary well-formed HTTP requests. Each request causes HttpParser::execute to allocate Url objects, HttpHeaders objects, and HttpHeader instances via raw new...

EUVD-2026-49900

TinyWeb through 0.0.8 contains a memory leak vulnerability that allows unauthenticated attackers to exhaust available memory by sending ordinary well-formed HTTP requests. Each request causes HttpParser::execute to allocate Url objects, HttpHeaders objects, and HttpHeader instances via raw new...

CVE-2026-12200

A security vulnerability has been detected in Ritlabs TinyWeb Server up to 1.94 on Win32. This impacts an unknown function in the library libeay32.dll.html of the component Header Handler. The manipulation of the argument Authorization leads to stack-based buffer overflow. The attack can be...

CVE-2026-12200 Ritlabs TinyWeb Server Header libeay32.dll.html stack-based overflow

A security vulnerability has been detected in Ritlabs TinyWeb Server up to 1.94 on Win32. This impacts an unknown function in the library libeay32.dll.html of the component Header Handler. The manipulation of the argument Authorization leads to stack-based buffer overflow. The attack can be...

CVE-2026-12200 Ritlabs TinyWeb Server Header libeay32.dll.html stack-based overflow

A security vulnerability has been detected in Ritlabs TinyWeb Server up to 1.94 on Win32. This impacts an unknown function in the library libeay32.dll.html of the component Header Handler. The manipulation of the argument Authorization leads to stack-based buffer overflow. The attack can be...

CVE-2026-12200

Ritlabs TinyWeb Server (Windows, up to v1.94) is affected by a stack-based buffer overflow in the Header Handler’s libeay32.dll.html component. The vulnerability is triggered by manipulating the Authorization argument, allowing remote exploitation. An exploit has been disclosed publicly, and the ...