{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2026-67183",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2026-67183",
    "idYear": 2026,
    "status": "PUBLISHED",
    "publishedAt": "2026-07-28T16:26:09.306Z",
    "updatedAt": "2026-07-28T17:22:18.525Z",
    "importedAt": "2026-10-24T01:58:25.636Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "TinyWeb 0.0.8 Memory Leak DoS via HTTP Request Handling",
      "summary": "TinyWeb through 0.0.8 contains a memory leak vulnerability that allows unauthenticated attackers to exhaust available memory by sending ordinary well-formed HTTP requests. Each request causes HttpParser::execute() to allocate Url objects, HttpHeaders objects, and HttpHeader instances via raw new expressions that are never freed due to missing destructors and unreachable delete calls, causing worker resident memory to grow monotonically by approximately 20 to 28 kB per request until the worker process is killed.",
      "affected": [
        {
          "vendor": "GeneralSandman",
          "product": "TinyWeb",
          "defaultStatus": "affected",
          "versions": [
            {
              "version": "e48f15d38d2bebeec9cabcfdde81931b10a1963b",
              "status": "affected",
              "versionType": "git",
              "lessThanOrEqual": "a381da252fe8e873c8aff22703040426cc9b2ae0"
            },
            {
              "version": "0.0.8",
              "status": "affected",
              "versionType": "semver"
            }
          ]
        }
      ]
    }
  }
}