CVE-2026-67183 describes a memory leak in GeneralSandman's TinyWeb version 0.0.8. The vulnerability occurs in the HttpParser::execute() function, which allocates Url, HttpHeaders, and HttpHeader objects using raw new expressions without corresponding delete calls or destructors. As a result, each HTTP request causes the worker process's resident memory to increase by approximately 20 to 28 kB. Over time, this leads to memory exhaustion and eventual termination of the worker process, enabling denial of service by unauthenticated attackers sending ordinary well-formed HTTP requests.

An unauthenticated attacker can repeatedly send normal HTTP requests to the affected TinyWeb server, causing a steady increase in memory consumption due to unreleased allocated objects. This memory leak can exhaust system memory, resulting in denial of service as the worker process is killed or crashes. There is no indication of direct code execution or data disclosure from this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider limiting exposure of the TinyWeb service to untrusted networks or implementing external resource usage monitoring and automated restarts to mitigate impact.