CVE-2026-28497: TinyWeb: Integer Overflow in `_Val` (HTTP Request Smuggling)
TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. Prior to version 2.03, an integer overflow vulnerability in the string-to-integer conversion routine (Val) allows an unauthenticated remote attacker to bypass Content-Length restrictions and perform HTTP Request Smuggling. This can lead to unauthorized access, security filter bypass, and potential cache poisoning. The impact is critical for servers using persistent connections (Keep-Alive). This issue has been patched in version 2.03.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-28497?
CVE-2026-28497 is considered a high severity vulnerability due to the potential for HTTP request smuggling.
How do I fix CVE-2026-28497?
To mitigate CVE-2026-28497, upgrade to TinyWeb version 2.03 or later.
Who is affected by CVE-2026-28497?
CVE-2026-28497 affects all versions of TinyWeb prior to version 2.03.
What type of vulnerability is CVE-2026-28497?
CVE-2026-28497 is classified as an integer overflow vulnerability.
Can CVE-2026-28497 be exploited remotely?
Yes, CVE-2026-28497 can be exploited by unauthenticated remote attackers.