CVE-2026-67185 is a high-severity path traversal vulnerability in TinyWeb 0.0.8 that allows unauthenticated attackers to read arbitrary files by submitting ../ sequences in the URL path. The vulnerability exists in HttpBuilder::buildResponse() where ../ sequences in the URL path are concatenated directly to the configured web root without normalization or boundary checks. This allows attackers to craft re [truncated]
CVE-2026-67183 is a memory leak vulnerability in TinyWeb 0.0.8 that allows unauthenticated attackers to cause memory exhaustion via well-formed HTTP requests. Each request causes a monotonic increase in worker resident memory by approximately 20 to 28 kB until the worker process is killed. The vulnerability is caused by missing destructors and unreachable delete calls in the HttpParser::execute() function.
