Skip to main content

Tinyweb CVE-2026-28497

CRITICAL
Integer Overflow or Wraparound (CWE-190)
2026-03-06 security-advisories@github.com
Authentication Bypass Integer Overflow Tinyweb Ritlabs
9.1
CVSS 3.1 · GitHub Advisory
Share

Severity by source

GitHub Advisory PRIMARY
9.1 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Mar 12, 2026 - 22:06 vuln.today
CVE Published
Mar 06, 2026 - 04:16 nvd
CRITICAL 9.1

DescriptionGitHub Advisory

TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. Prior to version 2.03, an integer overflow vulnerability in the string-to-integer conversion routine (_Val) allows an unauthenticated remote attacker to bypass Content-Length restrictions and perform HTTP Request Smuggling. This can lead to unauthorized access, security filter bypass, and potential cache poisoning. The impact is critical for servers using persistent connections (Keep-Alive). This issue has been patched in version 2.03.

AnalysisAI

Integer overflow in TinyWeb before 2.03.

Technical ContextAI

CWE-190.

RemediationAI

Update.

More in Tinyweb

View all
CVE-2026-67185 HIGH POC
8.7 Jul 28

Path traversal in TinyWeb through 0.0.8 allows unauthenticated remote attackers to read arbitrary files from the server'
CVE-2026-67184 HIGH POC
8.7 Jul 28

Null pointer dereference in TinyWeb 0.0.8 and earlier allows unauthenticated remote attackers to crash worker processes

CVE-2026-67183 HIGH POC
8.7 Jul 28

Memory exhaustion vulnerability in TinyWeb HTTP server (through 0.0.8) enables unauthenticated remote attackers to cause
CVE-2024-34199 HIGH POC
8.6 May 14

TinyWeb 1.94 and below allows unauthenticated remote attackers to cause a denial of service (Buffer Overflow) when sendi
CVE-2026-22781 CRITICAL
9.8 Jan 12

TinyWeb HTTP Server before 1.98 has OS command injection via CGI ISINDEX query parameters. The query string is passed as
CVE-2026-27613 CRITICAL
9.8 Feb 25

Unauthenticated command injection in TinyWeb HTTP/HTTPS server for Win32 before 2.01 allows remote attackers to execute

CVE-2024-5193 MEDIUM POC
5.5 May 22

A security vulnerability has been detected in Ritlabs TinyWeb Server 1.94. Rated medium severity (CVSS 5.5), this vulner
CVE-2026-29046 HIGH
8.2 Mar 06

TinyWeb versions prior to 2.04 fail to properly sanitize control characters and encoded sequences (CR, LF, NUL) in HTTP

CVE-2026-27633 HIGH
7.5 Feb 26

TinyWeb versions prior to 2.02 are vulnerable to denial of service through memory exhaustion when unauthenticated attack
CVE-2026-27630 HIGH
7.5 Feb 26

TinyWeb versions prior to 2.02 lack connection limits and request timeouts, enabling unauthenticated remote attackers to

Same weakness CWE-190 – Integer Overflow or Wraparound

View all
CVE-2013-2729 CRITICAL POC
9.8
CVE-2015-8651 HIGH
8.8
CVE-2012-5054 HIGH POC
8.8
CVE-2014-0569 CRITICAL POC
9.3
CVE-2023-21716 CRITICAL POC
9.8
CVE-2017-3599 HIGH POC
7.5
CVE-2017-7529 HIGH
7.5
CVE-2016-1010 HIGH
8.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2026-28497 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy