CVE-2026-67184 is a NULL pointer dereference in TinyWeb's HTTP parser that crashes worker processes permanently. The root cause is straightforward: HttpParser::execute() sets an internal 'valid_requ' flag when parsing succeeds, but buildResponse() never checks this flag before using the parsed request data. Send a request with an invalid HTTP version string—something as simple as a malformed header that disrupts version parsing—and the parser fails silently, leaving the request structure in an invalid state. Execution then proceeds into buildResponse(), which dereferences the uninitialized pointer, crashing the worker.
The critical detail is 'permanently offline until manually restarted.' This isn't just a crash—it's a crash that survives worker respawn attempts. Check whether your TinyWeb deployment has supervisor-level restart logic (systemd, runit, or similar) that can recover crashed workers. Even with a supervisor, understand that an attacker can crash workers faster than recovery triggers if the restart delay is too long, effectively creating a resource exhaustion DoS with minimal packets.
The fix should do more than add a NULL check. Examine whether the 'valid_requ' flag is consulted anywhere else in the codebase—if it exists but is unused elsewhere, you have the same vulnerability in multiple locations. The proper remediation is proper error propagation from HttpParser::execute() to the caller, ensuring malformed input triggers an error return rather than proceeding into response generation. Adding a NULL check without fixing the architectural gap just masks the problem.
Audit your other parsing paths in HttpParser::execute() for similar conditions where critical pointers might be left uninitialized but execution continues. This vulnerability is trivial to trigger—any scanner or casual attacker can send malformed HTTP and take your service offline.