CVE-2026-29046: Ritlabs Tinyweb

High severity, CVSS 8.2. EPSS: 0.6% chance of exploitation in the next 30 days.

TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. Prior to version 2.04, TinyWeb accepts request header values and later maps them into CGI environment variables (HTTP_*). The parser did not strictly reject dangerous control characters in header lines and header values, including CR, LF, and NUL, and did not consistently defend against encoded forms such as %0d, %0a, and %00. This can enable header value confusion across parser boundaries and may create unsafe data in the CGI execution context. This issue has been patched in version 2.04.

Affected products

• Ritlabs Tinyweb: before 2.04 (fixed in 2.04)

Published 2026-03-06. Last modified 2026-06-17.