Vulnerability · Published Mar 6, 2026 · Assigned by GitHub_M
CVE-2026-29046TinyWeb: HTTP Header Control Character Injection into CGI Environment
Critical 9.2
In plain English
A critical-severity improper input validation in TinyWeb from maximmasiutin. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).
Official description
TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. Prior to version 2.04, TinyWeb accepts request header values and later maps them into CGI environment variables (HTTP_*). The parser did not strictly reject dangerous control characters in header lines and header values, including CR, LF, and NUL, and did not consistently defend against encoded forms such as %0d, %0a, and %00. This can enable header value confusion across parser boundaries and may create unsafe data in the CGI execution context. This issue has been patched in version 2.04.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| maximmasiutin | TinyWeb | < 2.04 |
Weakness: CWE-114, CWE-20, CWE-74, CWE-93 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L