TinyWeb through 0.0.8 contains a memory leak vulnerability that allows unauthenticated attackers to exhaust available memory by sending ordinary well-formed HTT…

TinyWeb through version 0.0.8 contains a memory leak vulnerability exploitable by unauthenticated attackers. By sending ordinary well-formed HTTP requests, attackers can cause the server to exhaust available memory. The root cause lies in HttpParser::execute(), which allocates Url objects, HttpHeaders objects, and HttpHeader instances via raw new expressions that are never freed. Missing destructors and unreachable delete calls prevent proper memory cleanup. Worker resident memory grows monotonically by approximately 20 to 28 kB per request. This continues until the worker process is killed, resulting in a denial-of-service condition. No authentication is required to trigger the vulnerability, making it trivially exploitable.