CRITICAL🇵🇱 Wersja polska

CVE-2026-29046

CVSS 9.2v4.0pub. 2026-03-06upd. 2026-03-16

TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. Prior to version 2.04, TinyWeb accepts request header values and later maps them into CGI environment variables (HTTP_*). The parser did not strictly reject dangerous control characters in header lines and header values, including CR, LF, and NUL, and did not consistently defend against encoded forms such as %0d, %0a, and %00. This can enable header value confusion across parser boundaries and may create unsafe data in the CGI execution context. This issue has been patched in version 2.04.

🇵🇱 Read Polish description →

🤖 AI Analysis

How it works

The TinyWeb server accepts HTTP header values and maps them to CGI environment variables (HTTP_*). The parser did not strictly reject control characters such as CR (carriage return), LF (line feed), and NUL, both in raw and URL-encoded form (%0d, %0a, %00). The lack of this validation allows an attacker to smuggle additional headers or line-terminating characters, leading to so-called header value confusion at parser boundaries. Forged data can reach an unsafe execution context of CGI scripts.

Impact

An attacker can manipulate environment variables passed to CGI applications, potentially injecting additional headers or data, which may result in integrity violation of processed requests and data on the server side and CGI applications.

Mitigation & patch

TinyWeb should be updated to version 2.04, in which the issue has been fixed. A patch is available in the manufacturer's repository (commit 53aa8b6e5146491d7be57920e3fc50d7a34e4d5a on GitHub).

Who is affected

Ritlabs TinyWeb in versions earlier than 2.04 (HTTP/HTTPS server for Win32)

Analysis generated by Claude AI (Anthropic) based on NVD data. Always verify with vendor.

CVSS Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X