Vulnerability · Published Feb 25, 2026 · Assigned by GitHub_M
CVE-2026-27630TinyWeb vulnerable to Remote Denial of Service via Thread/Connection Exhaustion (Slowloris)
High 8.7
In plain English
A high-severity uncontrolled resource consumption in TinyWeb from maximmasiutin. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).
Official description
TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. Versions prior to version 2.02 are vulnerable to a Denial of Service (DoS) attack known as Slowloris. The server spawns a new OS thread for every incoming connection without enforcing a maximum concurrency limit or an appropriate request timeout. An unauthenticated remote attacker can exhaust server concurrency limits and memory by opening numerous connections and sending data exceptionally slowly (e.g. 1 byte every few minutes). Anyone hosting services using TinyWeb is impacted. Version 2.02 fixes the issue. The patch introduces a `CMaxConnections` limit (set to 512) and a `CConnectionTimeoutSecs` idle timeout (set to 30 seconds). As a temporary workaround if upgrading is not immediately possible, consider placing the server behind a robust reverse proxy or Web Application Firewall (WAF) such as nginx, HAProxy, or Cloudflare, configured to buffer incomplete requests and aggressively enforce connection limits and timeouts.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| maximmasiutin | TinyWeb | < 2.02 |
Weakness: CWE-400 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
References
- https://github.com/maximmasiutin/TinyWeb/security/advisories/GHSA-ccv5-8948-c99c x_refsource_CONFIRM
- https://github.com/maximmasiutin/TinyWeb/commit/23268c8 x_refsource_MISC
- https://www.masiutin.net/tinyweb-cve-2026-27630.html x_refsource_MISC