TinyWeb through version 0.0.8 is affected by a null pointer dereference vulnerability that can be exploited by unauthenticated remote attackers. The flaw resides in the HttpParser::execute() function, which fails to allocate a Url object when HTTP version parsing fails, leaving the url pointer as NULL. The buildResponse() function subsequently dereferences this NULL pointer without validating the valid_requ flag, resulting in a SIGSEGV signal that crashes the worker process. By repeatedly sending malformed HTTP requests with invalid version strings, an attacker can crash all worker processes and take the server permanently offline. The server requires a manual restart to recover, making this a viable denial-of-service attack vector. No authentication is required to trigger the vulnerability, significantly lowering the barrier for exploitation.