CVE-2026-67183 Details

A memory leak vulnerability has been identified in TinyWeb versions through 0.0.8. This vulnerability allows unauthenticated attackers to exhaust available memory by sending regular, well-formed HTTP requests. Each request triggers the `HttpParser::execute()` function to allocate `Url` objects, `HttpHeaders` objects, and individual `HttpHeader` instances using raw `new` expressions. These allocations are never released, as the structures lack destructors and the delete calls are unreachable. As a result, the worker's resident memory increases steadily by approximately 20 to 28 kB per request, until the worker process is terminated.

To address this vulnerability, implement destructors for the `HttpRequest` and `HttpHeaders` structures that properly release the allocated `Url`, `headers`, `body`, and each `HttpHeader` in the `generals` list. Alternatively, use smart pointers to manage these resources automatically. Additionally, ensure that the memory buffers used for per-request response processing are released after the response is sent.