Skip to main content

TinyWeb EUVDEUVD-2026-49902

| CVE-2026-67184 HIGH
NULL Pointer Dereference (CWE-476)
2026-07-28 VulnCheck GHSA-r4g2-gw8j-xgxv
Denial Of Service Null Pointer Dereference Tinyweb
8.7
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.5 HIGH

Network accessible, low complexity, no privileges or user interaction, only availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Jul 28, 2026 - 17:15 vuln.today
CVE Published
Jul 28, 2026 - 16:28 cve.org
HIGH 8.7

DescriptionCVE.org

TinyWeb through 0.0.8 contains a null pointer dereference vulnerability that allows unauthenticated remote attackers to crash worker processes by sending a malformed HTTP request line with an invalid version string. The HttpParser::execute() function fails to allocate the Url object when version parsing fails, leaving the url pointer NULL, and buildResponse() subsequently dereferences this NULL pointer without checking the valid_requ flag, producing a SIGSEGV that terminates the worker process and, when repeated across all workers, takes the server permanently offline until manually restarted.

AnalysisAI

Null pointer dereference in TinyWeb 0.0.8 and earlier allows unauthenticated remote attackers to crash worker processes by sending an HTTP request with a malformed version string, causing a permanent denial of service when all workers are terminated. A publicly available proof-of-concept exploit exists, though no active exploitation has been confirmed.

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Send malformed HTTP request
Delivery
HttpParser fails to allocate Url
Exploit
buildResponse dereferences NULL url
Execution
Worker process crashes
Persist
Repeat to crash all workers
Impact
Server permanently offline until manual restart
Sign in to reveal

Vulnerability AssessmentAI

Exploitation No special conditions - remote unauthenticated exploitation against default configurations of TinyWeb. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H/VC:N/VI:N) indicates an easily exploitable, unauthenticated, remote denial of service with high availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker sends a crafted HTTP request with an invalid version (e.g., 'GET / HTTP/9.9') to the TinyWeb server. The parser fails to allocate the URL object, causing a null pointer dereference in the response builder and crashing the worker. …
Remediation No vendor-released patch is available. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Tinyweb

View all
CVE-2026-67185 HIGH POC
8.7 Jul 28

Path traversal in TinyWeb through 0.0.8 allows unauthenticated remote attackers to read arbitrary files from the server'
CVE-2026-67183 HIGH POC
8.7 Jul 28

Memory exhaustion vulnerability in TinyWeb HTTP server (through 0.0.8) enables unauthenticated remote attackers to cause
CVE-2024-34199 HIGH POC
8.6 May 14

TinyWeb 1.94 and below allows unauthenticated remote attackers to cause a denial of service (Buffer Overflow) when sendi
CVE-2026-22781 CRITICAL
9.8 Jan 12

TinyWeb HTTP Server before 1.98 has OS command injection via CGI ISINDEX query parameters. The query string is passed as
CVE-2026-27613 CRITICAL
9.8 Feb 25

Unauthenticated command injection in TinyWeb HTTP/HTTPS server for Win32 before 2.01 allows remote attackers to execute

CVE-2024-5193 MEDIUM POC
5.5 May 22

A security vulnerability has been detected in Ritlabs TinyWeb Server 1.94. Rated medium severity (CVSS 5.5), this vulner
CVE-2026-28497 CRITICAL
9.1 Mar 06

Integer overflow in TinyWeb before 2.03.
CVE-2026-29046 HIGH
8.2 Mar 06

TinyWeb versions prior to 2.04 fail to properly sanitize control characters and encoded sequences (CR, LF, NUL) in HTTP

CVE-2026-27633 HIGH
7.5 Feb 26

TinyWeb versions prior to 2.02 are vulnerable to denial of service through memory exhaustion when unauthenticated attack
CVE-2026-27630 HIGH
7.5 Feb 26

TinyWeb versions prior to 2.02 lack connection limits and request timeouts, enabling unauthenticated remote attackers to

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2015-3194 HIGH
7.5
CVE-2026-21525 MEDIUM
6.2
CVE-2017-0016 MEDIUM
5.9

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Share

EUVD-2026-49902 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy