EUVD-2026-49902
GHSA-r4g2-gw8j-xgxv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network accessible, low complexity, no privileges or user interaction, only availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
TinyWeb through 0.0.8 contains a null pointer dereference vulnerability that allows unauthenticated remote attackers to crash worker processes by sending a malformed HTTP request line with an invalid version string. The HttpParser::execute() function fails to allocate the Url object when version parsing fails, leaving the url pointer NULL, and buildResponse() subsequently dereferences this NULL pointer without checking the valid_requ flag, producing a SIGSEGV that terminates the worker process and, when repeated across all workers, takes the server permanently offline until manually restarted.
AnalysisAI
Null pointer dereference in TinyWeb 0.0.8 and earlier allows unauthenticated remote attackers to crash worker processes by sending an HTTP request with a malformed version string, causing a permanent denial of service when all workers are terminated. A publicly available proof-of-concept exploit exists, though no active exploitation has been confirmed.
Technical ContextAI
The vulnerability lies in the TinyWeb HTTP parser (HttpParser::execute()), written in C++. When parsing the HTTP request line, if the version string (e.g., 'HTTP/9.9') is invalid, the parser fails to allocate a Url object, leaving the url pointer NULL. Later, buildResponse() dereferences this pointer without checking the valid_requ flag, triggering a null pointer dereference (CWE-476) and a SIGSEGV that crashes the worker. This affects all versions up to 0.0.8 as per the CPE string cpe:2.3:a:generalsandman:tinyweb:*:*:*:*:*:*:*:*.
RemediationAI
No vendor-released patch is available. As a permanent fix, consider migrating to an actively maintained, similar lightweight HTTP server. As a temporary workaround, restrict network access to TinyWeb using firewall rules to trusted IPs only, or place a reverse proxy (e.g., nginx) in front that validates HTTP request lines before forwarding, though this adds complexity. Monitor worker processes and configure automatic restarts to reduce downtime, but this does not prevent an attacker from keeping the service offline by continuous crashing.
Path traversal in TinyWeb through 0.0.8 allows unauthenticated remote attackers to read arbitrary files from the server'
Memory exhaustion vulnerability in TinyWeb HTTP server (through 0.0.8) enables unauthenticated remote attackers to cause
TinyWeb 1.94 and below allows unauthenticated remote attackers to cause a denial of service (Buffer Overflow) when sendi
TinyWeb HTTP Server before 1.98 has OS command injection via CGI ISINDEX query parameters. The query string is passed as
Unauthenticated command injection in TinyWeb HTTP/HTTPS server for Win32 before 2.01 allows remote attackers to execute
A security vulnerability has been detected in Ritlabs TinyWeb Server 1.94. Rated medium severity (CVSS 5.5), this vulner
Integer overflow in TinyWeb before 2.03.
TinyWeb versions prior to 2.04 fail to properly sanitize control characters and encoded sequences (CR, LF, NUL) in HTTP
TinyWeb versions prior to 2.02 are vulnerable to denial of service through memory exhaustion when unauthenticated attack
TinyWeb versions prior to 2.02 lack connection limits and request timeouts, enabling unauthenticated remote attackers to
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today