EUVD-2026-49902
GHSA-r4g2-gw8j-xgxv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend malformed HTTP request
-
DeliveryHttpParser fails to allocate Url
-
ExploitbuildResponse dereferences NULL url
-
ExecutionWorker process crashes
-
PersistRepeat to crash all workers
-
ImpactServer permanently offline until manual restart
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of TinyWeb. The vulnerability is triggered by any malformed HTTP request containing an invalid version string, requiring only network reachability to the service. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H/VC:N/VI:N) indicates an easily exploitable, unauthenticated, remote denial of service with high availability impact. No EPSS score is available to gauge exploitation probability. The vulnerability has a public POC but is not listed in CISA KEV, suggesting limited real-world exploitation. The SSVC decision would likely be 'Attend' due to the existence of exploit code and high availability impact, though TinyWeb's limited deployment may lower organizational priority. The risk is moderate-critical for affected instances but not a widespread threat. |
| Exploit ScenarioDerived | An attacker sends a crafted HTTP request with an invalid version (e.g., 'GET / HTTP/9.9') to the TinyWeb server. The parser fails to allocate the URL object, causing a null pointer dereference in the response builder and crashing the worker. By repeating this request, all workers are terminated, making the server unresponsive until manually restarted. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 28, 2026
Null pointer dereference in TinyWeb 0.0.8 and earlier allows unauthenticated remote attackers to crash worker processes by sending an HTTP request with a malformed version string, causing a permanent denial of service when all workers are terminated. A publicly available proof-of-concept exploit exists, though no active exploitation has been confirmed.
RemediationAI
No vendor-released patch is available. As a permanent fix, consider migrating to an actively maintained, similar lightweight HTTP server. As a temporary workaround, restrict network access to TinyWeb using firewall rules to trusted IPs only, or place a reverse proxy (e.g., nginx) in front that validates HTTP request lines before forwarding, though this adds complexity. Monitor worker processes and configure automatic restarts to reduce downtime, but this does not prevent an attacker from keeping the service offline by continuous crashing.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability lies in the TinyWeb HTTP parser (HttpParser::execute()), written in C++. When parsing the HTTP request line, if the version string (e.g., 'HTTP/9.9') is invalid, the parser fails to allocate a Url object, leaving the url pointer NULL. Later, buildResponse() dereferences this pointer without checking the valid_requ flag, triggering a null pointer dereference (CWE-476) and a SIGSEGV that crashes the worker. This affects all versions up to 0.0.8 as per the CPE string cpe:2.3:a:generalsandman:tinyweb:*:*:*:*:*:*:*:*.
Know when Tinyweb gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Network accessible, low complexity, no privileges or user interaction, only availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
TinyWeb through 0.0.8 contains a null pointer dereference vulnerability that allows unauthenticated remote attackers to crash worker processes by sending a malformed HTTP request line with an invalid version string. The HttpParser::execute() function fails to allocate the Url object when version parsing fails, leaving the url pointer NULL, and buildResponse() subsequently dereferences this NULL pointer without checking the valid_requ flag, producing a SIGSEGV that terminates the worker process and, when repeated across all workers, takes the server permanently offline until manually restarted.
Latest POC
1 PoC candidate from github (unverified)
Sign in to open the public PoC links collected for this CVE.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Path traversal in TinyWeb through 0.0.8 allows unauthenticated remote attackers to read arbitrary files from the server'
Memory exhaustion vulnerability in TinyWeb HTTP server (through 0.0.8) enables unauthenticated remote attackers to cause
TinyWeb 1.94 and below allows unauthenticated remote attackers to cause a denial of service (Buffer Overflow) when sendi
TinyWeb HTTP Server before 1.98 has OS command injection via CGI ISINDEX query parameters. The query string is passed as
Unauthenticated command injection in TinyWeb HTTP/HTTPS server for Win32 before 2.01 allows remote attackers to execute
A security vulnerability has been detected in Ritlabs TinyWeb Server 1.94. Rated medium severity (CVSS 5.5), this vulner
Integer overflow in TinyWeb before 2.03.
TinyWeb versions prior to 2.04 fail to properly sanitize control characters and encoded sequences (CR, LF, NUL) in HTTP
TinyWeb versions prior to 2.02 are vulnerable to denial of service through memory exhaustion when unauthenticated attack
TinyWeb versions prior to 2.02 lack connection limits and request timeouts, enabling unauthenticated remote attackers to
Exploit-DB