CVE-2026-29046: TinyWeb: HTTP Header Control Character Injection into CGI Environment
TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. Prior to version 2.04, TinyWeb accepts request header values and later maps them into CGI environment variables (HTTP). The parser did not strictly reject dangerous control characters in header lines and header values, including CR, LF, and NUL, and did not consistently defend against encoded forms such as %0d, %0a, and %00. This can enable header value confusion across parser boundaries and may create unsafe data in the CGI execution context. This issue has been patched in version 2.04.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-29046?
CVE-2026-29046 has been classified as a moderate severity vulnerability.
How do I fix CVE-2026-29046?
To fix CVE-2026-29046, upgrade TinyWeb to version 2.04 or later.
What systems are affected by CVE-2026-29046?
CVE-2026-29046 affects TinyWeb versions prior to 2.04.
What is the nature of CVE-2026-29046?
CVE-2026-29046 involves HTTP header control character injection into the CGI environment.
What are the potential risks of CVE-2026-29046?
The risks of CVE-2026-29046 include potential denial of service or unexpected behavior in applications that process CGI environment variables.