What’s Vulnerable › Vulnerabilities

CVE-2026-29046: TinyWeb: HTTP Header Control Character Injection into CGI Environment

• Severity: high (CVSS 8.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-03-06 · updated 2026-06-17
• Weakness: CWE-20

Description

TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. Prior to version 2.04, TinyWeb accepts request header values and later maps them into CGI environment variables (HTTP_*). The parser did not strictly reject dangerous control characters in header lines and header values, including CR, LF, and NUL, and did not consistently defend against encoded forms such as %0d, %0a, and %00. This can enable header value confusion across parser boundaries and may create unsafe data in the CGI execution context. This issue has been patched in version 2.04.

Affected products

• maximmasiutin TinyWeb: before 2.04 — fixed in 2.04

How to fix

Upgrade to a fixed version: maximmasiutin TinyWeb 2.04. Check the vendor advisory for mitigations.

References

• https://github.com/maximmasiutin/TinyWeb/commit/53aa8b6e5146491d7be57920e3fc50d7a34e4d5a
• https://github.com/maximmasiutin/TinyWeb/security/advisories/GHSA-r3gf-pg2c-m7mc

Get alerted when CVE-2026-29046 or the next vulnerability affects your stack