The vulnerability arises from TinyWeb 0.0.8’s HTTP parser, which fails to allocate a URL object when parsing an invalid HTTP version string. Consequently, a null pointer is dereferenced in the response builder, causing a segmentation fault that terminates the worker process. Repeated exploitation across all worker processes can bring the entire server down, requiring manual restart. This flaw grants attackers the ability to force a permanent service outage without any authentication or privilege escalation, impacting confidentiality and availability of the affected web service.

The flaw affects the TinyWeb web server, specifically version 0.0.8 and all earlier releases distributed by GeneralSandman. No specific patch version is listed in the data, but the issue exists until a newer release resolves the null pointer dereference. Systems running this software without a recent update are at risk.

The CVSS score of 8.7 indicates a high severity. The EPSS score of less than 1% suggests a very low probability of exploitation in the wild, and the vulnerability is not currently listed in CISA’s KEV catalog. Attackers can exploit the weakness remotely, unauthenticated, by sending a malicious HTTP request line with an invalid version string. The exploit requires only network access to the server’s HTTP interface and does not demand additional privileges, making it accessible to a broad range of threat actors. Although the exploitation likelihood is low, the potential impact is substantial, especially for services that cannot tolerate downtime.