CVE-2026-29046: falha crítica em maximmasiutin TinyWeb
TinyWeb: HTTP Header Control Character Injection into CGI Environment
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.2epss 0.4%
TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. Prior to version 2.04, TinyWeb accepts request header values and later maps them into CGI environment variables (HTTP_*). The parser did not strictly reject dangerous control characters in header lines and header values, including CR, LF, and NUL, and did not consistently defend against encoded forms such as %0d, %0a, and %00. This can enable header value confusion across parser boundaries and may create unsafe data in the CGI execution context. This issue has been patched in version 2.04.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L
Produtos afetados
maximmasiutin · TinyWebCVEs relacionadas — maximmasiutin TinyWeb
No mesmo produto, das mais perigosas para as menos.
CVE-2026-22781CRITICALTinyWeb CGI Command InjectionEPSS 2.4%CVE-2026-27613CRITICALCGI Parameter Injection (Bypass of STRICT_CGI_PARAMS and EscapeShellParam)EPSS 0.9%CVE-2026-28497CRITICALTinyWeb: Integer Overflow in `_Val` (HTTP Request Smuggling)EPSS 0.5%CVE-2026-27633HIGHTinyWeb has Unbounded Content-Length Memory Exhaustion (DoS)EPSS 0.5%CVE-2026-27630HIGHTinyWeb vulnerable to Remote Denial of Service via Thread/Connection Exhaustion (Slowloris)EPSS 0.5%