CVE-2026-28497 TinyWeb: Integer Overflow in `_Val` (HTTP Request Smuggling)
An integer overflow in TinyWeb allows remote attackers to bypass Content-Length restrictions and perform HTTP request smuggling, leading to security filter bypass and cache poisoning.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-28497?
CVE-2026-28497 is a critical vulnerability in maximmasiutin TinyWeb, published on 6 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. Prior to version 2.03, an integer overflow vulnerability in the string-to-integer conversion routine (_Val) allows an unauthenticated remote attacker to bypass Content-Length restrictions and perform HTTP Request Smuggling. This can lead to unauthorized access, security filter bypass, and potential cache poisoning. The impact is critical for servers using persistent connections (Keep-Alive). This issue has been patched in version 2.03.
Which versions are affected by CVE-2026-28497?
It affects 1 product.
Products include Ritlabs Tinyweb.
How do I fix CVE-2026-28497?
No fix has been published for CVE-2026-28497 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-28497 being exploited?
There is no known exploitation of CVE-2026-28497 in the wild and no public exploit code.
Other vulnerabilities in maximmasiutin TinyWeb
- CVE-2026-27613 CGI Parameter Injection (Bypass of STRICT_CGI_PARAMS and EscapeShellParam)
- CVE-2026-22781 TinyWeb CGI Command Injection
- CVE-2026-29046 TinyWeb: HTTP Header Control Character Injection into CGI Environment
- CVE-2026-27630 TinyWeb vulnerable to Remote Denial of Service via Thread/Connection Exhaustion (Slowloris)
- CVE-2026-27633 TinyWeb has Unbounded Content-Length Memory Exhaustion (DoS)
Sources
Also known as GHSA-rp8j-cx7r-mw9f.