CVE-2026-67183
High · 7.5CVSS
7.5
EPSS
0.5%
Published
Jul 28, 2026
CISA due date
—
The record
TinyWeb through 0.0.8 contains a memory leak vulnerability that allows unauthenticated attackers to exhaust available memory by sending ordinary well-formed HTTP requests. Each request causes HttpParser::execute() to allocate Url objects, HttpHeaders objects, and HttpHeader instances via raw new expressions that are never freed due to missing destructors and unreachable delete calls, causing worker resident memory to grow monotonically by approximately 20 to 28 kB per request until the worker process is killed.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-119286 GraphQL-core is a Python port of the GraphQL.js reference implementation. CWE-401
- CVE-2026-116157 ImageMagick before 7.1.2-33 contains a memory leak vulnerability in PerlMagick that fails… CWE-401
- CVE-2026-116158 ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the magick compare… CWE-401
- CVE-2026-116159 ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the… CWE-401
- CVE-2026-116156 ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak caused by a… CWE-401
- CVE-2026-116151 ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the JNG… CWE-401
- CVE-2026-116155 ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the… CWE-401
- CVE-2026-116152 ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the MAT decoder that… CWE-401