Security Advisories for all TinyWeb CVEs. Last updated: 2026-02-25.
Summary
This document provides a centralized index of all security vulnerabilities in TinyWeb HTTP Server that have
been assigned MITRE CVE identifiers. All identified vulnerabilities have been fixed in the current version of
the server.
CVE-2026-27633 (Fixed in v2.02) - Unbounded Content-Length Memory Exhaustion
Severity
8.7 High (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N)
Description
TinyWeb fails to enforce a maximum limit on HTTP request body size before allocation. An
unauthenticated remote attacker can send a request with a large Content-Length value, causing memory
exhaustion.
Fix Details
Introduced CMaxEntityBodySize (default 10MB) to reject oversized payloads with HTTP
413.
CVE-2026-27630 (Fixed in v2.02) - Thread/Connection Exhaustion (Slowloris)
Severity
8.7 High (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N)
Description
TinyWeb's one-thread-per-connection model without concurrency limits allows unauthenticated remote
attackers to exhaust the server's thread limit or memory by sending data exceptionally slowly.
Fix Details
Introduced CMaxConnections (default 512) and CConnectionTimeoutSecs
(default 30s) to limit resources.
Insufficient validation of hyphens and incorrect shell escaping for Win32 binaries allow attackers
to bypass STRICT_CGI_PARAMS and EscapeShellParam, leading to Source Code Disclosure or RCE.
Fix Details
Rejected query parameters starting with hyphens and updated escaping to use \" instead
of ^".
Unsanitized ISINDEX-style query parameters passed to CreateProcess() allowed
unauthenticated remote attackers to execute arbitrary OS commands via Windows shell metacharacters.
Fix Details
Implemented IsQueryParamSafe whitelist and EscapeShellParam function to
sanitize input.
CVE-2024-34199 (Fixed in v1.99) - Buffer Overflow / Denial of Service
Severity
8.6 High (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H)
Description
Unbounded heap growth in TCollector.Collect() when parsing HTTP request lines allowed
unauthenticated remote attackers to crash the server by sending oversized request lines.
Fix Details
Implemented CMaxHeaderLineLength (8KB) and CMaxTotalHeaderSize (64KB)
limits.
URL-encoded CRLF sequences in request paths were decoded and included directly in
Location redirect headers, allowing HTTP header injection and response splitting.
Fix Details
Implemented StripCRLF() to sanitize all strings before usage in HTTP response headers.
The /./ path component bypassed the CGI script detection logic, causing the server to
return the raw source code of CGI scripts instead of executing them.
Fix Details
Blocked \.\ patterns and implemented ExpandFileName() suffix verification
and component validation.