GHSA-ccv5-8948-c99c: TinyWeb vulnerable to Remote Denial of Service via Thread/Connection Exhaustion (Slowloris)

Q: Which deployments are exposed to this issue?

Any service hosted with TinyWeb versions before 2.02 is affected. The attack can be performed remotely over the network against HTTP or HTTPS services.

Q: What does an attacker need to exploit it?

No authentication or user interaction is required. An attacker can open many connections and send request data very slowly, consuming threads and memory until the server can no longer handle legitimate connections.

Q: Are connection limits and request timeouts enabled by default in the fixed release?

Version 2.02 adds a maximum-connection limit of 512 and an idle connection timeout of 30 seconds. Earlier versions do not enforce an appropriate concurrency limit or request timeout.

Q: What can be done if upgrading to version 2.02 is not immediately possible?

Place TinyWeb behind a robust reverse proxy or WAF, such as nginx, HAProxy, or Cloudflare. Configure it to buffer incomplete requests and aggressively enforce connection limits and timeouts.

Published Feb 25, 2026

Updated

TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. Versions prior to version 2.02 are vulnerable to a Denial of Service (DoS) attack known as Slowloris. The server spawns a new OS thread for every incoming connection without enforcing a maximum concurrency limit or an appropriate request timeout. An unauthenticated remote attacker can exhaust server concurrency limits and memory by opening numerous connections and sending data exceptionally slowly (e.g. 1 byte every few minutes). Anyone hosting services using TinyWeb is impacted. Version 2.02 fixes the issue. The patch introduces a CMaxConnections limit (set to 512) and a CConnectionTimeoutSecs idle timeout (set to 30 seconds). As a temporary workaround if upgrading is not immediately possible, consider placing the server behind a robust reverse proxy or Web Application Firewall (WAF) such as nginx, HAProxy, or Cloudflare, configured to buffer incomplete requests and aggressively enforce connection limits and timeouts.

Affected Software

1 affected component

TinyWeb TinyWeb<2.02

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade TinyWeb to a version that resolves this vulnerability.
Fixed in 2.02
Compensating control
Until upgrading, place TinyWeb behind a robust reverse proxy or WAF such as nginx, HAProxy, or Cloudflare, configured to buffer incomplete requests and aggressively enforce connection limits and timeouts.

Event History

Feb 25, 2026

CVE Published

via OSV·11:05 PM

Data Sourced

via OSV·11:05 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Any service hosted with TinyWeb versions before 2.02 is affected. The attack can be performed remotely over the network against HTTP or HTTPS services.

What does an attacker need to exploit it?

No authentication or user interaction is required. An attacker can open many connections and send request data very slowly, consuming threads and memory until the server can no longer handle legitimate connections.

Are connection limits and request timeouts enabled by default in the fixed release?

Version 2.02 adds a maximum-connection limit of 512 and an idle connection timeout of 30 seconds. Earlier versions do not enforce an appropriate concurrency limit or request timeout.

What can be done if upgrading to version 2.02 is not immediately possible?

Place TinyWeb behind a robust reverse proxy or WAF, such as nginx, HAProxy, or Cloudflare. Configure it to buffer incomplete requests and aggressively enforce connection limits and timeouts.

GHSA-ccv5-8948-c99c: TinyWeb vulnerable to Remote Denial of Service via Thread/Connection Exhaustion (Slowloris)

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

Are connection limits and request timeouts enabled by default in the fixed release?

What can be done if upgrading to version 2.02 is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

Are connection limits and request timeouts enabled by default in the fixed release?

What can be done if upgrading to version 2.02 is not immediately possible?