What is the CVSS score of CVE-2026-27630?

CVE-2026-27630 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of Tinyweb are affected by CVE-2026-27630?

TinyWeb servers running versions prior to 2.02 are vulnerable to Slowloris denial of service attacks that can render web services unavailable to legitimate users.. A patch is available.

How to fix or mitigate CVE-2026-27630?

Within 24 hours: Identify all TinyWeb deployments and their versions in your environment. Within 7 days: Apply vendor patch to upgrade TinyWeb to version 2.02 or later across all affected systems. Within 30 days: Validate patch deployment, conduct post-patch testing, and update asset inventory.

Tinyweb CVE-2026-27630

HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-02-26 security-advisories@github.com

Nginx Denial Of Service Tinyweb

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

Patch released

Feb 28, 2026 - 01:01 nvd

Patch available

CVE Published

Feb 26, 2026 - 00:16 nvd

HIGH 7.5

DescriptionGitHub Advisory

TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. Versions prior to version 2.02 are vulnerable to a Denial of Service (DoS) attack known as Slowloris. The server spawns a new OS thread for every incoming connection without enforcing a maximum concurrency limit or an appropriate request timeout. An unauthenticated remote attacker can exhaust server concurrency limits and memory by opening numerous connections and sending data exceptionally slowly (e.g. 1 byte every few minutes). Anyone hosting services using TinyWeb is impacted. Version 2.02 fixes the issue. The patch introduces a CMaxConnections limit (set to 512) and a CConnectionTimeoutSecs idle timeout (set to 30 seconds). As a temporary workaround if upgrading is not immediately possible, consider placing the server behind a robust reverse proxy or Web Application Firewall (WAF) such as nginx, HAProxy, or Cloudflare, configured to buffer incomplete requests and aggressively enforce connection limits and timeouts.

AnalysisAI

TinyWeb versions prior to 2.02 lack connection limits and request timeouts, enabling unauthenticated remote attackers to trigger denial of service through Slowloris attacks by maintaining numerous concurrent connections and transmitting data at minimal rates. The vulnerability affects all systems running vulnerable TinyWeb instances, with attackers capable of exhausting server resources and rendering services unavailable. A patch is available that implements connection limits and idle timeouts to mitigate the attack vector.

Technical ContextAI

Classified as CWE-400 (Uncontrolled Resource Consumption). Affects Tinyweb. TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. Versions prior to version 2.02 are vulnerable to a Denial of Service (DoS) attack known as Slowloris. The server spawns a new OS thread for every incoming connection without enforcing a maximum concurrency limit or an appropriate request timeout. An unauthenticated remote attacker can exhaust server concurrency limits and memory by opening numerous connections and sending data exceptionally slowly (e.g. 1 byte every few minutes).