CVE-2026-67184
Received Received - Intake

Null Pointer Dereference in TinyWeb HTTP Parser

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: VulnCheck

Description
TinyWeb through 0.0.8 contains a null pointer dereference vulnerability that allows unauthenticated remote attackers to crash worker processes by sending a malformed HTTP request line with an invalid version string. The HttpParser::execute() function fails to allocate the Url object when version parsing fails, leaving the url pointer NULL, and buildResponse() subsequently dereferences this NULL pointer without checking the valid_requ flag, producing a SIGSEGV that terminates the worker process and, when repeated across all workers, takes the server permanently offline until manually restarted.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-28
Last Modified
2026-07-28
Generated
2026-07-28
AI Q&A
2026-07-28
EPSS Evaluated
N/A
NVD
CVE-2026-67184
EUVD
EUVD-2026-49902

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
tinyweb tinyweb 0.0.8

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

TinyWeb through 0.0.8 has a null pointer dereference flaw where unauthenticated attackers can crash worker processes by sending a malformed HTTP request with an invalid version string. The parser fails to allocate a URL object when version parsing fails, leaving a NULL pointer. The response builder then crashes when dereferencing this NULL pointer, causing a SIGSEGV that terminates the worker process.

Detection Guidance

To detect this vulnerability, monitor for server crashes or segmentation faults when sending malformed HTTP requests. Use tools like curl to send a test request with an invalid version string, e.g., 'curl -v http://<target-ip>:9090/ XTTP/1.1'. Check server logs for SIGSEGV errors or worker process terminations.

Impact Analysis

This vulnerability allows remote attackers to crash TinyWeb servers by sending specially crafted HTTP requests. Repeated exploitation can exhaust all worker processes, causing a denial-of-service (DoS) where the server becomes unresponsive until manually restarted. No authentication is required for exploitation.

Compliance Impact

This vulnerability primarily causes denial-of-service conditions by crashing server workers, which could lead to prolonged service unavailability. For GDPR, this may impact availability of personal data processing systems, potentially violating Article 32 requirements for resilience. HIPAA-covered entities might face disruptions in critical healthcare services, risking compliance with availability and integrity standards under the Security Rule.

Mitigation Strategies

Immediate mitigation includes blocking malformed HTTP requests at the network perimeter using firewalls or WAF rules. Temporarily disable the TinyWeb service if no patch is available. Monitor for exploitation attempts and consider switching to a different web server until a fix is released.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-67184. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart