CVE-2026-28497

An integer overflow error in the internal _Val procedure responsible for converting a string to an integer value causes improper processing of the Content-Length header value in HTTP requests. An attacker can craft an HTTP request with a Content-Length value that causes an overflow, resulting in a discrepancy between how the frontend and backend servers interpret request boundaries — the essence of an HTTP Request Smuggling attack (CWE-444). The attack requires no authentication or user interaction.

An attacker can gain unauthorized access to resources, bypass security filters, and potentially poison the server cache (cache poisoning), which may affect other users using the server.

TinyWeb should be updated to version 2.03, where the issue has been fixed. Patch available in the project's GitHub repository (commit d2edd0322c3d74beee0a6c0191299b8946695d4e). Until the update is applied, it is recommended to consider disabling Keep-Alive connections and restricting access to the server using a firewall.

Ritlabs TinyWeb — versions before 2.03 (HTTP/HTTPS server written in Delphi for Win32 platform); the vulnerability is particularly severe when Keep-Alive connections are enabled.