PT-2026-23630 · Tinyweb · Tinyweb

Maximmasiutin · Publicado 2026-03-06 · Atualizado 2026-03-16 · CVE-2026-29046

Positive Technologies (AI Summary)

CVSS v4.0

9.2

Crítica

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L

Name of the Vulnerable Software and Affected Versions TinyWeb versions prior to 2.04

Description TinyWeb, a web server for Win32, is susceptible to a header value confusion issue due to insufficient sanitization of control characters (CR, LF, and NUL, including encoded forms like %0d, %0a, and %00) within HTTP request headers. The parser's failure to strictly reject these characters and consistently defend against encoded forms can lead to unsafe data being introduced into the CGI execution context via HTTP * environment variables. This could potentially enable malicious manipulation of CGI processes.

Recommendations Update to version 2.04 or later.

Exploit

Correção

Special Elements Injection

RCE

Enumeração de Fraquezas

CWE-114

CWE-93

CWE-74

CWE-20

Identificadores relacionados

CVE-2026-29046

GHSA-R3GF-PG2C-M7MC

Produtos afetados

Tinyweb

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29046.json · Exploit
• https://github.com/maximmasiutin/TinyWeb/commit/53aa8b6e5146491d7be57920e3fc50d7a34e4d5a · Correção
• https://github.com/maximmasiutin/TinyWeb/security/advisories/GHSA-r3gf-pg2c-m7mc · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-29046 · Nota de Segurança
• https://twitter.com/cyberbivash/status/2029786106556739845 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-29046 · Aviso do Fabricante
• https://t.me/cveNotify/155507 · Publicação no Telegram
• https://twitter.com/CCBalert/status/2029973903322276249 · Publicação no Twitter