CRITICAL🇵🇱 Wersja polska

CVE-2026-28497

CVSS 9.3v4.0pub. 2026-03-06upd. 2026-03-16

TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. Prior to version 2.03, an integer overflow vulnerability in the string-to-integer conversion routine (_Val) allows an unauthenticated remote attacker to bypass Content-Length restrictions and perform HTTP Request Smuggling. This can lead to unauthorized access, security filter bypass, and potential cache poisoning. The impact is critical for servers using persistent connections (Keep-Alive). This issue has been patched in version 2.03.

CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

  • Ritlabs Tinyweb

    APP
    Ritlabs
    < 2.03
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2026-29046CRITICAL9.2PL ✓ten sam produkt

TinyWeb: nieprawidłowa walidacja nagłówków HTTP umożliwia header injection

CVE-2026-27613CRITICAL10.0PL ✓ten sam produkt

RCE lub ujawnienie kodu źródłowego w TinyWeb przez pominięcie kontroli parametrów CGI

CVE-2026-22781CRITICAL10.0PL ✓ten sam produkt

Command injection w TinyWeb HTTP Server via parametry CGI ISINDEX

CVE-2026-27630HIGH8.7ten sam produkt

TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. Versions prior to version 2.02 are vulnerab...

CVE-2026-27633HIGH8.7ten sam produkt

TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. Versions prior to version 2.02 have a Denia...