CVE-2026-29046: maximmasiutin tinyweb Improper Input Validation

Vulnerability summary

CVE-2026-29046 is a critical (CVSS 9.2) Improper Input Validation vulnerability in maximmasiutin tinyweb. EPSS estimates a 0.58% chance of exploitation in the next 30 days, higher than 46.8% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 06-03-2026
   PublishedVulnerability first disclosed.
2. 06-03-2026
   Last modifiedVulnerability information updated.

Description

TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. Prior to version 2.04, TinyWeb accepts request header values and later maps them into CGI environment variables (HTTP_*). The parser did not strictly reject dangerous control characters in header lines and header values, including CR, LF, and NUL, and did not consistently defend against encoded forms such as %0d, %0a, and %00. This can enable header value confusion across parser boundaries and may create unsafe data in the CGI execution context. This issue has been patched in version 2.04.

• CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
• CWE-74Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
• CWE-93Improper Neutralization of CRLF Sequences ('CRLF Injection')The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.
• CWE-114Process ControlExecuting commands or loading libraries from an untrusted source or in an untrusted environment can cause an application to execute malicious commands (and payloads) on behalf of an attacker.