EUVD-2026-36675
GHSA-gpg8-377c-3rgp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend HTTP request with oversized Authorization header
-
DeliveryTrigger stack buffer overflow in libeay32.dll Header Handler
-
ExploitOverwrite return address on stack
-
ExecutionRedirect execution to attacker-controlled payload
-
ImpactExecute arbitrary code as TinyWeb process user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special configuration is required beyond the server being reachable over the network: TinyWeb Server's HTTP Authorization header parsing is active by default on all deployments, and the overflow is triggered by any HTTP request containing a crafted Authorization header value regardless of whether authentication is actually enforced on the targeted resource. The CVSS 4.0 vector confirms AV:N/AC:L/AT:N/PR:N/UI:N - exploitation requires no prior authentication, no elevated privileges, no user interaction, and no special attack preparation. The limiting factors are: (1) platform scope is Win32 only; (2) the software is niche and unlikely to be internet-facing at scale; (3) reliable code execution (vs. crash/DoS) may depend on the absence of exploit mitigations such as stack canaries and DEP, which are absent in many legacy TinyWeb builds but should be verified per deployment. |
| Impact | The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms the vulnerability is trivially reachable over the network with no authentication, no complexity barrier, and no user interaction required - the most dangerous attack profile possible from an access perspective. Impact metrics are rated Low across confidentiality, integrity, and availability (VC:L/VI:L/VA:L), which may reflect the demonstrated POC achieving only a service crash rather than confirmed code execution, or conservative scoring by the reporter. However, stack-based buffer overflows of this class routinely escalate to full RCE when stack protections are absent, which is common in software of this vintage and niche. The E:P supplemental metric confirms a public exploit exists. This is NOT listed in CISA KEV, so active widespread exploitation is not confirmed. TinyWeb is a niche, lightweight server primarily used in embedded or legacy Windows environments, which limits the total exposed population - but any internet-facing instance should be treated as critically at risk given the zero-barrier exploitation conditions, public POC, and absence of any vendor patch. |
| Exploit ScenarioDerived | An unauthenticated remote attacker sends a single HTTP request to TinyWeb Server containing an oversized or specially crafted value in the Authorization header field; the Header Handler in libeay32.dll copies this input into a fixed stack buffer without bounds checking, overwriting the return address. On systems without effective stack canaries or DEP enforcement - typical of legacy Win32 TinyWeb deployments - the attacker controls instruction flow and can achieve arbitrary code execution in the context of the TinyWeb process. A public proof-of-concept demonstrating this technique has been published at nathan2.com/posts/tinyweb/. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 15, 2026
Stack-based buffer overflow in Ritlabs TinyWeb Server 1.94 and earlier on Win32 allows remote unauthenticated attackers to crash the server or potentially execute arbitrary code by sending a specially crafted HTTP Authorization header, triggering a memory corruption condition in the libeay32.dll component's Header Handler. A public proof-of-concept exploit has been disclosed at nathan2.com/posts/tinyweb/, and the vendor has not responded to responsible disclosure notifications, leaving all known versions unpatched. No active exploitation has been confirmed in CISA KEV, though the combination of a public POC, network-reachable attack surface, and no patch represents a meaningful risk for any deployment of this software.
RemediationAI
No vendor-released patch has been identified at time of analysis; the vendor was contacted prior to disclosure and did not respond, leaving this vulnerability unresolved. The primary recommendation is to immediately take TinyWeb Server offline or replace it with an actively maintained HTTP server alternative. If the server cannot be removed, compensating controls should be applied in order of preference: first, restrict network access to TinyWeb using host-based or network firewall rules so only trusted IP ranges can reach it, which eliminates the network-accessible attack vector entirely; second, deploy a reverse proxy or WAF in front of TinyWeb that strips or validates the Authorization header before forwarding requests, blocking malformed inputs before they reach the vulnerable parser. Note that the reverse proxy approach introduces additional infrastructure complexity and its own attack surface. Blocking inbound requests at the perimeter is simpler but does not protect against threats from trusted internal networks. References: https://vuldb.com/cve/CVE-2026-12200, POC: https://nathan2.com/posts/tinyweb/
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-121 (Stack-Based Buffer Overflow): attacker-controlled input in the HTTP Authorization header is written into a fixed-size stack buffer within the Header Handler component without adequate length validation, overwriting the return address or frame pointer and corrupting adjacent stack memory. The affected library reference (libeay32.dll) is a legacy Win32 OpenSSL runtime DLL historically bundled with older Windows applications; its presence here suggests TinyWeb embeds or depends on this outdated cryptographic library for parsing HTTP authentication credentials. The affected product is identified via CPE cpe:2.3:a:ritlabs:tinyweb_server:*:*:*:*:*:*:*:* scoped to Win32 platforms running versions up to and including 1.94. Stack overflows of this class are well-understood and, when mitigations such as stack canaries, DEP, or ASLR are absent or improperly implemented - as is common in legacy Win32 applications - are routinely exploitable for arbitrary code execution.
Know when Tinyweb Server gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Network-reachable with no auth or interaction; availability rated High as stack overflow reliably crashes the process; C/I rated Low reflecting demonstrated POC scope, not confirmed RCE.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
1DescriptionCVE.org
A security vulnerability has been detected in Ritlabs TinyWeb Server up to 1.94 on Win32. This impacts an unknown function in the library libeay32.dll.html of the component Header Handler. The manipulation of the argument Authorization leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Exploit-DB