CyberRota Analysis
AI-GeneratedTinyWeb versions up to 0.0.8 are vulnerable to a null pointer dereference that can be exploited by unauthenticated remote attackers through malformed HTTP requests, leading to the crashing of worker processes. This vulnerability can cause a denial of service, rendering the server inoperable until it is manually restarted. Organizations using TinyWeb should prioritize patching this vulnerability to prevent potential service disruptions.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
TinyWeb through 0.0.8 contains a null pointer dereference vulnerability that allows unauthenticated remote attackers to crash worker processes by sending a malformed HTTP request line with an invalid version string. The HttpParser::execute() function fails to allocate the Url object when version parsing fails, leaving the url pointer NULL, and buildResponse() subsequently dereferences this NULL pointer without checking the valid_requ flag, producing a SIGSEGV that terminates the worker process and, when repeated across all workers, takes the server permanently offline until manually restarted.