PT-2026-22038 · Tinyweb · Tinyweb

Maxim Masiutin + 1 · Publicado 2026-02-25 · Atualizado 2026-03-03 · CVE-2026-27630

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions TinyWeb versions prior to 2.02

Description TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. The server creates a new operating system thread for each incoming connection without enforcing a maximum concurrency limit or an appropriate request timeout. An unauthenticated remote attacker can exhaust server concurrency limits and memory by opening numerous connections and sending data very slowly. This is known as a Slowloris attack. The CMaxConnections limit is set to 512 and the CConnectionTimeoutSecs idle timeout is set to 30 seconds in version 2.02.

Recommendations Versions prior to 2.02 should be upgraded to version 2.02.

Exploit

Correção

DoS

Allocation of Resources Without Limits

Resource Exhaustion

Enumeração de Fraquezas

CWE-770

CWE-400

Identificadores relacionados

CVE-2026-27630

GHSA-CCV5-8948-C99C

Produtos afetados

Tinyweb

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27630.json · Exploit
• https://github.com/maximmasiutin/TinyWeb/security/advisories/GHSA-ccv5-8948-c99c · Aviso do Fabricante
• https://github.com/maximmasiutin/TinyWeb/commit/23268c8 · Correção
• https://t.me/CVEtracker/45786 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2026-27630 · Aviso do Fabricante
• https://t.me/cveNotify/153272 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-27630 · Nota de Segurança
• https://masiutin.net/tinyweb-cve-2026-27630.html · Nota
• https://twitter.com/cracbot/status/2028787611389808970 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2027004267316338919 · Publicação no Twitter
• https://twitter.com/infoflowcloud/status/2027006149807993056 · Publicação no Twitter