Generalsandman
Monthly
Path traversal in TinyWeb through 0.0.8 allows unauthenticated remote attackers to read arbitrary files from the server's filesystem by injecting ../ sequences into the URL path, which are concatenated without normalization in HttpBuilder::buildResponse(). Publicly available exploit code exists, yet no active exploitation is recorded in CISA KEV; the risk is elevated when the server runs as root, exposing credential stores and private keys.
Null pointer dereference in TinyWeb 0.0.8 and earlier allows unauthenticated remote attackers to crash worker processes by sending an HTTP request with a malformed version string, causing a permanent denial of service when all workers are terminated. A publicly available proof-of-concept exploit exists, though no active exploitation has been confirmed.
Memory exhaustion vulnerability in TinyWeb HTTP server (through 0.0.8) enables unauthenticated remote attackers to cause denial of service by sending ordinary HTTP requests. A memory leak in the request parser allocates objects without freeing them, consuming approximately 20–28 kB per request until the worker process is killed. Publicly available exploit code exists, but no active exploitation has been confirmed via CISA KEV.
Path traversal in TinyWeb through 0.0.8 allows unauthenticated remote attackers to read arbitrary files from the server's filesystem by injecting ../ sequences into the URL path, which are concatenated without normalization in HttpBuilder::buildResponse(). Publicly available exploit code exists, yet no active exploitation is recorded in CISA KEV; the risk is elevated when the server runs as root, exposing credential stores and private keys.
Null pointer dereference in TinyWeb 0.0.8 and earlier allows unauthenticated remote attackers to crash worker processes by sending an HTTP request with a malformed version string, causing a permanent denial of service when all workers are terminated. A publicly available proof-of-concept exploit exists, though no active exploitation has been confirmed.
Memory exhaustion vulnerability in TinyWeb HTTP server (through 0.0.8) enables unauthenticated remote attackers to cause denial of service by sending ordinary HTTP requests. A memory leak in the request parser allocates objects without freeing them, consuming approximately 20–28 kB per request until the worker process is killed. Publicly available exploit code exists, but no active exploitation has been confirmed via CISA KEV.