CVE-2026-67184 Details

A null pointer dereference vulnerability has been identified in TinyWeb versions through 0.0.8. This vulnerability allows unauthenticated remote attackers to crash worker processes by sending malformed HTTP request lines with invalid version strings. The issue arises in the HttpParser::execute() function, which fails to allocate the Url object when version parsing encounters an error, leaving the url pointer NULL. The buildResponse() function then dereferences this NULL pointer without verifying the valid_requ flag, causing a segmentation fault (SIGSEGV) that terminates the worker process. When this occurs across all workers, the server goes offline permanently until manually restarted.

To address this vulnerability, modify the dataReceived() function to build an error response and return when valid_requ is false, instead of calling buildResponse(). Additionally, check req->url for NULL in buildResponse() before using it. Allocating the URL object before parsing could also prevent this issue.