PT-2026-23629 · Tinyweb · Tinyweb

Maximmasiutin · Publicado 2026-03-06 · Atualizado 2026-03-06 · CVE-2026-28497

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Crítica

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions TinyWeb versions prior to 2.03

Description An integer overflow exists in the string-to-integer conversion routine ( Val). This allows a remote, unauthenticated attacker to bypass Content-Length restrictions and perform HTTP Request Smuggling. Successful exploitation can lead to unauthorized access, security filter bypass, and potential cache poisoning. The impact is critical for servers utilizing persistent connections (Keep-Alive).

Recommendations Update to version 2.03 or later.

Exploit

Correção

HTTP Request/Response Smuggling

Integer Overflow

Enumeração de Fraquezas

CWE-444

CWE-190

Identificadores relacionados

CVE-2026-28497

GHSA-RP8J-CX7R-MW9F

Produtos afetados

Tinyweb

Referências · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28497.json · Exploit
• https://github.com/maximmasiutin/TinyWeb/commit/d2edd0322c3d74beee0a6c0191299b8946695d4e · Correção
• https://github.com/maximmasiutin/TinyWeb/security/advisories/GHSA-rp8j-cx7r-mw9f · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-28497 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-28497 · Aviso do Fabricante
• https://twitter.com/CCBalert/status/2029973903322276249 · Publicação no Twitter