CVE-2026-28497CRITICAL 9.1EPSS p36.8%
CVE-2026-28497CVE-2026-28497
Description
TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. Prior to version 2.03, an integer overflow vulnerability in the string-to-integer conversion routine (_Val) allows an unauthenticated remote attacker to bypass Content-Length restrictions and perform HTTP Request Smuggling. This can lead to unauthorized access, security filter bypass, and potential cache poisoning. The impact is critical for servers using persistent connections (Keep-Alive). This issue has been patched in version 2.03.
Scoring
| CVSS 3.1 | 9.1 (CRITICAL) |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H |
| EPSS | 0.47% probability of exploitation · percentile 36.8% · 2026-06-18T12:00:27Z |
| Published | 2026-03-06 |
| Last modified | 2026-03-16 |
Underlying weaknesses· 2
References
2
| Type | Target | Confidence | Tier |
|---|---|---|---|
| Weakness | Integer Overflow or Wraparoundcwe-190 | 0% | live |
| Weakness | Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')cwe-444 | 0% | live |
Related by meaning· 6
Nearest entities by semantic similarity across the cs-graph corpus.