CVE-2025-3266 is a high severity (CVSS 7.3) stack-based buffer overflow in qinguoyi TinyWebServer up to version 1.0. The name and password handling in /http/http_conn.cpp copies input into a fixed buffer. The record names no fix, so keep the server off untrusted networks and patch the code if you use it.
What's affected
qinguoyi TinyWebServer up to and including 1.0, per the CVE record. The file named is /http/http_conn.cpp and the manipulated arguments are name and password.
The vector shows network access, low complexity, no privileges and no user interaction, with low impact in each of confidentiality, integrity and availability. The record says the exploit has been disclosed publicly and may be used. It makes no claim of exploitation in the wild.
No fixed version is named. TinyWebServer is a small C++ project often used for learning, so it is rarely tracked by organizations. Another CVE in the same file, CVE-2025-3268, covers an improper authentication issue.
How to check if you're exposed
Find out whether you run TinyWebServer or a fork of it. Search your repositories and servers for the project name and for the file:
grep -rl 'http_conn' --include=*.cpp .
If you do, read the code that parses the name and password fields and look for fixed size buffers filled with unchecked copies.
Check whether the server is reachable from outside your network, since the vector allows network attacks without a login.
What to do now
- Do not expose TinyWebServer to the internet or to untrusted networks.
- If you use it, fix the parsing code to check lengths before copying, or use safer string types.
- Build with stack protection and address sanitizer in testing to catch similar overflows.
- Run the process as an unprivileged user inside a container with limited capabilities.
- Replace the server with a maintained web server if it is used for anything beyond learning.
Why it matters
The classes are CWE-119 (Memory Buffer Bounds), CWE-121 (Stack-based Buffer Overflow) and CWE-787 (Out-of-bounds Write). Request fields are copied into a fixed buffer on the stack without a length check, so a long value overwrites what sits next to it.
Memory safety bugs in network parsers are a long running theme. They persist in small C and C++ projects because the code was written for learning or speed, then reused. Static analysis can find these patterns early, and that is what the demo below shows.
The record does not mark this CVE as CISA KEV and makes no claim of exploitation in the wild.
Try it yourself
Unchecked copies into fixed buffers are a pattern static analysis catches well. This demo shows a code scan and its findings.
Click through it at your own pace, or open it full screen.
Quick check
Is TinyWebServer production software?
It is a small project that is often used to learn how web servers work. If you find it in production, plan a replacement.
Sources
Last reviewed: 18 October 2026.
