TinyWeb versions through 0.0.8 contain a memory leak that allows attackers to exhaust available memory by sending well‑formed HTTP requests. The flaw resides in HttpParser::execute(), which allocates Url, HttpHeaders and HttpHeader objects with raw new expressions that are never freed. Each request thus increases resident memory by approximately 20 to 28 kB, eventually killing the worker process and bringing the web server to an unresponsive state. This results in a denial‑of‑service vulnerability.

The issue affects the TinyWeb web server product from GeneralSandman, specifically all releases up to and including version 0.0.8. The vulnerability exists regardless of authentication status, so any external or internal user can trigger it by sending normal HTTP traffic.

The CVSS score of 8.7 indicates a high‑severity flaw. The EPSS score is less than 1 %, suggesting that the probability of widespread exploitation is currently low, and the vulnerability is not listed in the CISA KEV catalog. However, because the attack vector is merely an unauthenticated HTTP request, an attacker can easily trigger the leak from any network location with access to the target. The lack of a deallocation path makes the vulnerability highly exploitable when sufficient request volume is supplied.