EUVD-2026-36675
GHSA-gpg8-377c-3rgp
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with no auth or interaction; availability rated High as stack overflow reliably crashes the process; C/I rated Low reflecting demonstrated POC scope, not confirmed RCE.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A security vulnerability has been detected in Ritlabs TinyWeb Server up to 1.94 on Win32. This impacts an unknown function in the library libeay32.dll.html of the component Header Handler. The manipulation of the argument Authorization leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Stack-based buffer overflow in Ritlabs TinyWeb Server 1.94 and earlier on Win32 allows remote unauthenticated attackers to crash the server or potentially execute arbitrary code by sending a specially crafted HTTP Authorization header, triggering a memory corruption condition in the libeay32.dll component's Header Handler. A public proof-of-concept exploit has been disclosed at nathan2.com/posts/tinyweb/, and the vendor has not responded to responsible disclosure notifications, leaving all known versions unpatched. No active exploitation has been confirmed in CISA KEV, though the combination of a public POC, network-reachable attack surface, and no patch represents a meaningful risk for any deployment of this software.
Technical ContextAI
The root cause is CWE-121 (Stack-Based Buffer Overflow): attacker-controlled input in the HTTP Authorization header is written into a fixed-size stack buffer within the Header Handler component without adequate length validation, overwriting the return address or frame pointer and corrupting adjacent stack memory. The affected library reference (libeay32.dll) is a legacy Win32 OpenSSL runtime DLL historically bundled with older Windows applications; its presence here suggests TinyWeb embeds or depends on this outdated cryptographic library for parsing HTTP authentication credentials. The affected product is identified via CPE cpe:2.3:a:ritlabs:tinyweb_server:*:*:*:*:*:*:*:* scoped to Win32 platforms running versions up to and including 1.94. Stack overflows of this class are well-understood and, when mitigations such as stack canaries, DEP, or ASLR are absent or improperly implemented - as is common in legacy Win32 applications - are routinely exploitable for arbitrary code execution.
RemediationAI
No vendor-released patch has been identified at time of analysis; the vendor was contacted prior to disclosure and did not respond, leaving this vulnerability unresolved. The primary recommendation is to immediately take TinyWeb Server offline or replace it with an actively maintained HTTP server alternative. If the server cannot be removed, compensating controls should be applied in order of preference: first, restrict network access to TinyWeb using host-based or network firewall rules so only trusted IP ranges can reach it, which eliminates the network-accessible attack vector entirely; second, deploy a reverse proxy or WAF in front of TinyWeb that strips or validates the Authorization header before forwarding requests, blocking malformed inputs before they reach the vulnerable parser. Note that the reverse proxy approach introduces additional infrastructure complexity and its own attack surface. Blocking inbound requests at the perimeter is simpler but does not protect against threats from trusted internal networks. References: https://vuldb.com/cve/CVE-2026-12200, POC: https://nathan2.com/posts/tinyweb/
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today