PT-2026-23630 · Tinyweb · Tinyweb

Maximmasiutin · Published 2026-03-06 · Updated 2026-03-16 · CVE-2026-29046

Positive Technologies (AI Summary)

CVSS v4.0

9.2

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L

Name of the Vulnerable Software and Affected Versions TinyWeb versions prior to 2.04

Description TinyWeb, a web server for Win32, is susceptible to a header value confusion issue due to insufficient sanitization of control characters (CR, LF, and NUL, including encoded forms like %0d, %0a, and %00) within HTTP request headers. The parser's failure to strictly reject these characters and consistently defend against encoded forms can lead to unsafe data being introduced into the CGI execution context via HTTP * environment variables. This could potentially enable malicious manipulation of CGI processes.

Recommendations Update to version 2.04 or later.

Exploit

Fix

Special Elements Injection

RCE

Weakness Enumeration

CWE-114

CWE-93

CWE-74

CWE-20

Related Identifiers

CVE-2026-29046

GHSA-R3GF-PG2C-M7MC

Affected Products

Tinyweb

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29046.json · Exploit
• https://github.com/maximmasiutin/TinyWeb/commit/53aa8b6e5146491d7be57920e3fc50d7a34e4d5a · Patch
• https://github.com/maximmasiutin/TinyWeb/security/advisories/GHSA-r3gf-pg2c-m7mc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-29046 · Security Note
• https://osv.dev/vulnerability/CVE-2026-29046 · Vendor Advisory
• https://twitter.com/cyberbivash/status/2029786106556739845 · Twitter Post
• https://t.me/cveNotify/155507 · Telegram Post
• https://twitter.com/CCBalert/status/2029973903322276249 · Twitter Post