Maxim Masutin

**Name of the Vulnerable Software and Affected Versions** TinyWeb versions prior to 2.02 **Description** TinyWeb is a web server written in Delphi for Win32. Versions prior to 2.02 are susceptible to a Denial of Service (DoS) condition caused by memory exhaustion. An unauthenticated remote attacker can send an HTTP POST request to the server with a very large `Content-Length` header, such as `2147483647`. The server allocates memory for the request body (`EntityBody`) continuously while processing the payload, without any size restrictions. This leads to the consumption of all available memory, ultimately causing the server to crash. Any service hosted using TinyWeb is potentially impacted. The issue is resolved in version 2.02, which introduces a `CMaxEntityBodySize` limit of 10MB for incoming payloads. **Recommendations** Versions prior to 2.02 should be upgraded to version 2.02 or later. As a temporary workaround, if upgrading is not immediately possible, consider placing the server behind a Web Application Firewall (WAF) or reverse proxy (like nginx or Cloudflare) configured to limit the maximum allowed HTTP request body size (e.g., `client max body size` in nginx).

**Name of the Vulnerable Software and Affected Versions** TinyWeb versions prior to 1.98 **Description** TinyWeb is a web server for Win32. Versions of TinyWeb HTTP Server before 1.98 contain a flaw that allows for operating system command injection. This occurs through CGI ISINDEX-style query parameters, which are passed as command-line arguments to a CGI executable using the Windows `CreateProcess()` function. A remote attacker who does not need to be authenticated can execute arbitrary commands on the server by injecting Windows shell metacharacters into HTTP requests. The vulnerable parameters are passed to the `CreateProcess()` function. **Recommendations** Update to TinyWeb version 1.98 or later.