A critical memory corruption vulnerability exists in the Zaher1307 tiny_web_server that allows remote, unauthenticated attackers to trigger a stack buffer overflow, potentially leading to arbitrary code execution.

The application utilizes the unsafe sprintf function within the client_error routine to process user-controlled URI input without boundary validation. This flaw allows an unauthenticated remote attacker to overflow a fixed-size stack buffer by sending a maliciously crafted HTTP GET request.

The vulnerability carries a CVSS score of 7.3, reflecting a high potential for impact on system availability and integrity. Successful exploitation could result in a denial of service, unauthorized information disclosure, or full system compromise through remote code execution. This poses a significant risk to the stability of any infrastructure relying on this web server component.

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the affected service via network-level controls or discontinue its use in production environments.

Proactive Monitoring: Monitor server logs and system health metrics for abnormal process crashes or memory access violations that may indicate exploitation attempts.

Compensating Controls: Implement a Web Application Firewall (WAF) to inspect incoming HTTP requests and drop traffic containing excessively long URIs that exceed standard length requirements.

Public Exploit Available: Yes — a functional proof-of-concept is documented in the referenced GitHub issue tracker.

Given the availability of a public proof-of-concept and the lack of a vendor-provided fix, this vulnerability must be treated with high urgency. Organizations should prioritize isolating instances of tiny_web_server from public-facing networks to prevent remote exploitation. Continuous vigilance is required until the maintainer provides a version that replaces unsafe string manipulation functions with secure alternatives.