CVE-2026-29046

Katalog CVE

CVSS 8.2 · High EPSS 0,58%

Kerentanan Improper Input Validation pada ritlabs tinyweb. Skor CVSS 3.1 8.2 (High) menurut NVD.

Deskripsi (NVD)

TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. Prior to version 2.04, TinyWeb accepts request header values and later maps them into CGI environment variables (HTTP_*). The parser did not strictly reject dangerous control characters in header lines and header values, including CR, LF, and NUL, and did not consistently defend against encoded forms such as %0d, %0a, and %00. This can enable header value confusion across parser boundaries and may create unsafe data in the CGI execution context. This issue has been patched in version 2.04.

Rincian

Terbit di NVD

6 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation
CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')
CWE-114: Process Control

EPSS (30 hari)

0,58% peluang dieksploitasi; lebih tinggi dari 46,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/maximmasiutin/TinyWeb/security/advisories/GHSA-r3gf-pg2c-m7mc exploit · advisory vendor
• https://github.com/maximmasiutin/TinyWeb/commit/53aa8b6e5146491d7be57920e3fc50d7a34e4d5a patch