CVE-2026-2940

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2940", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-02-21T15:20:46.556Z", "datePublished": "2026-02-22T10:02:08.625Z", "dateUpdated": "2026-02-23T19:12:30.061Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-22T10:02:08.625Z"}, "title": "Zaher1307 tiny_web_server URL tiny.c out-of-bounds write", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-787", "lang": "en", "description": "Out-of-bounds Write"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-119", "lang": "en", "description": "Memory Corruption"}]}], "affected": [{"vendor": "Zaher1307", "product": "tiny_web_server", "versions": [{"version": "8d77b1044a0ca3a5297d8726ac8aa2cf944d481b", "status": "affected"}], "modules": ["URL Handler"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was determined in Zaher1307 tiny_web_server up to 8d77b1044a0ca3a5297d8726ac8aa2cf944d481b. This affects the function tiny_web_server/tiny.c of the file tiny_web_server/tiny.c of the component URL Handler. This manipulation causes out-of-bounds write. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 7.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "HIGH"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 7.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "HIGH"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-02-21T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-02-21T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-02-21T16:26:01.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "ypuluzm (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/?id.347312", "name": "VDB-347312 | Zaher1307 tiny_web_server URL tiny.c out-of-bounds write", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.347312", "name": "VDB-347312 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.756036", "name": "Submit #756036 | Zaher1307 TinyWebServer >0.0.0 Stack-based Buffer Overflow", "tags": ["third-party-advisory"]}, {"url": "https://github.com/Zaher1307/tiny_web_server/issues/1", "tags": ["issue-tracking"]}, {"url": "https://github.com/Zaher1307/tiny_web_server/issues/1#issue-3924357507", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/Zaher1307/tiny_web_server/", "tags": ["product"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-23T19:11:51.331869Z", "id": "CVE-2026-2940", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-23T19:12:30.061Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2940", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-23T19:11:51.331869Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-23T19:12:21.588Z"}}], "cna": {"title": "Zaher1307 tiny_web_server URL tiny.c out-of-bounds write", "credits": [{"lang": "en", "type": "reporter", "value": "ypuluzm (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"vendor": "Zaher1307", "modules": ["URL Handler"], "product": "tiny_web_server", "versions": [{"status": "affected", "version": "8d77b1044a0ca3a5297d8726ac8aa2cf944d481b"}]}], "timeline": [{"lang": "en", "time": "2026-02-21T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-02-21T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-02-21T16:26:01.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.347312", "name": "VDB-347312 | Zaher1307 tiny_web_server URL tiny.c out-of-bounds write", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.347312", "name": "VDB-347312 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.756036", "name": "Submit #756036 | Zaher1307 TinyWebServer >0.0.0 Stack-based Buffer Overflow", "tags": ["third-party-advisory"]}, {"url": "https://github.com/Zaher1307/tiny_web_server/issues/1", "tags": ["issue-tracking"]}, {"url": "https://github.com/Zaher1307/tiny_web_server/issues/1#issue-3924357507", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/Zaher1307/tiny_web_server/", "tags": ["product"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was determined in Zaher1307 tiny_web_server up to 8d77b1044a0ca3a5297d8726ac8aa2cf944d481b. This affects the function tiny_web_server/tiny.c of the file tiny_web_server/tiny.c of the component URL Handler. This manipulation causes out-of-bounds write. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "Out-of-bounds Write"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-119", "description": "Memory Corruption"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-22T10:02:08.625Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2940", "state": "PUBLISHED", "dateUpdated": "2026-02-23T19:12:30.061Z", "dateReserved": "2026-02-21T15:20:46.556Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-02-22T10:02:08.625Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"modules": ["URL Handler"], "product": "tiny_web_server", "vendor": "Zaher1307", "versions": [{"status": "affected", "version": "8d77b1044a0ca3a5297d8726ac8aa2cf944d481b"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was determined in Zaher1307 tiny_web_server up to 8d77b1044a0ca3a5297d8726ac8aa2cf944d481b. This affects the function tiny_web_server/tiny.c of the file tiny_web_server/tiny.c of the component URL Handler. This manipulation causes out-of-bounds write. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet."}, {"lang": "es", "value": "Se determin\u00f3 una vulnerabilidad en Zaher1307 tiny_web_server hasta 8d77b1044a0ca3a5297d8726ac8aa2cf944d481b. Esto afecta a la funci\u00f3n tiny_web_server/tiny.c del archivo tiny_web_server/tiny.c del componente Gestor de URL. Esta manipulaci\u00f3n provoca una escritura fuera de l\u00edmites. El ataque puede iniciarse de forma remota. El exploit ha sido divulgado p\u00fablicamente y puede ser utilizado. Este producto utiliza entrega continua con lanzamientos continuos. Por lo tanto, no hay detalles de versi\u00f3n disponibles de las versiones afectadas ni actualizadas. Se inform\u00f3 al proyecto del problema con antelaci\u00f3n mediante un informe de incidencias, pero a\u00fan no ha respondido."}], "id": "CVE-2026-2940", "lastModified": "2026-06-17T10:32:04.637", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2940", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-23T19:11:51.331869Z", "version": "2.0.3"}}]}, "published": "2026-02-22T10:15:56.747", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/Zaher1307/tiny_web_server/"}, {"source": "cna@vuldb.com", "url": "https://github.com/Zaher1307/tiny_web_server/issues/1"}, {"source": "cna@vuldb.com", "url": "https://github.com/Zaher1307/tiny_web_server/issues/1#issue-3924357507"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?ctiid.347312"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?id.347312"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?submit.756036"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-119"}, {"lang": "en", "value": "CWE-787"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "8d77b1044a0ca3a5297d8726ac8aa2cf944d481b"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "tiny_web_server", "source": "cna", "vendor": "Zaher1307"}, "product": "tiny_web_server", "vendor": "zaher1307"}], "analysis": {"en": {"generated_at": "2026-04-17T16:32:05.912232+00:00", "value": {"mitigation_remediation": ["Check the project\u2019s GitHub releases or commit history for a fixed version, and update tiny_web_server when a patch is released.", "If no patch is currently available, temporarily disable the vulnerable URL handler or configure the server to serve that route only to trusted IP addresses.", "Restrict inbound traffic to the tiny_web_server port to limit exposure while a fix is pending."], "summary": {"action": "Patch when available", "impact": "Remote code execution via memory corruption"}, "threat_synthesis": {"affected_systems": "The affected vendor is Zaher1307 and the product is tiny_web_server. The flaw exists in commits up to 8d77b1044a0ca3a5297d8726ac8aa2cf944d481b. Continuous delivery of the project means any legacy or unpatched instance may be vulnerable, but no specific patched versions have been released yet.", "description_and_impact": "The vulnerability is an out-of-bounds write in the URL handler of Zaher1307\u2019s tiny_web_server. A malformed URL can overwrite adjacent memory, potentially leading to memory corruption and hence remote code execution.", "risk_and_exploitability": "The CVSS score of 6.9 classifies it as medium severity, while the EPSS score of less than 1\u202f% indicates a low likelihood of exploitation at present. The vulnerability can be triggered remotely through crafted URLs, and it has already been publicly disclosed. Because it is not in the KEV catalog, current threat monitoring efforts should focus on the open-source issue tracker and the project\u2019s GitHub repository."}}}}, "created": "2026-02-23T14:29:17.412230+00:00", "updated": "2026-04-17T16:45:15.818555+00:00", "vendors": ["zaher1307", "zaher1307$PRODUCT$tiny_web_server"]}