PT-2026-22038 · Tinyweb · Tinyweb

Maxim Masiutin + 1 · Published 2026-02-25 · Updated 2026-03-03 · CVE-2026-27630

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions TinyWeb versions prior to 2.02

Description TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. The server creates a new operating system thread for each incoming connection without enforcing a maximum concurrency limit or an appropriate request timeout. An unauthenticated remote attacker can exhaust server concurrency limits and memory by opening numerous connections and sending data very slowly. This is known as a Slowloris attack. The CMaxConnections limit is set to 512 and the CConnectionTimeoutSecs idle timeout is set to 30 seconds in version 2.02.

Recommendations Versions prior to 2.02 should be upgraded to version 2.02.

Exploit

Fix

DoS

Allocation of Resources Without Limits

Resource Exhaustion

Weakness Enumeration

CWE-770

CWE-400

Related Identifiers

CVE-2026-27630

GHSA-CCV5-8948-C99C

Affected Products

Tinyweb

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27630.json · Exploit
• https://github.com/maximmasiutin/TinyWeb/security/advisories/GHSA-ccv5-8948-c99c · Vendor Advisory
• https://github.com/maximmasiutin/TinyWeb/commit/23268c8 · Patch
• https://osv.dev/vulnerability/CVE-2026-27630 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27630 · Security Note
• https://t.me/CVEtracker/45786 · Telegram Post
• https://t.me/cveNotify/153272 · Telegram Post
• https://masiutin.net/tinyweb-cve-2026-27630.html · Note
• https://twitter.com/cracbot/status/2028787611389808970 · Twitter Post
• https://twitter.com/CVEnew/status/2027004267316338919 · Twitter Post
• https://twitter.com/infoflowcloud/status/2027006149807993056 · Twitter Post