CVE-2026-27630

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27630", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-20T22:02:30.028Z", "datePublished": "2026-02-25T23:05:16.563Z", "dateUpdated": "2026-02-26T16:50:51.538Z"}, "containers": {"cna": {"title": "TinyWeb vulnerable to Remote Denial of Service via Thread/Connection Exhaustion (Slowloris)", "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "lang": "en", "description": "CWE-400: Uncontrolled Resource Consumption", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/maximmasiutin/TinyWeb/security/advisories/GHSA-ccv5-8948-c99c", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/maximmasiutin/TinyWeb/security/advisories/GHSA-ccv5-8948-c99c"}, {"name": "https://github.com/maximmasiutin/TinyWeb/commit/23268c8", "tags": ["x_refsource_MISC"], "url": "https://github.com/maximmasiutin/TinyWeb/commit/23268c8"}, {"name": "https://www.masiutin.net/tinyweb-cve-2026-27630.html", "tags": ["x_refsource_MISC"], "url": "https://www.masiutin.net/tinyweb-cve-2026-27630.html"}], "affected": [{"vendor": "maximmasiutin", "product": "TinyWeb", "versions": [{"version": "< 2.02", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-25T23:07:56.613Z"}, "descriptions": [{"lang": "en", "value": "TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. Versions prior to version 2.02 are vulnerable to a Denial of Service (DoS) attack known as Slowloris. The server spawns a new OS thread for every incoming connection without enforcing a maximum concurrency limit or an appropriate request timeout. An unauthenticated remote attacker can exhaust server concurrency limits and memory by opening numerous connections and sending data exceptionally slowly (e.g. 1 byte every few minutes). Anyone hosting services using TinyWeb is impacted. Version 2.02 fixes the issue. The patch introduces a `CMaxConnections` limit (set to 512) and a `CConnectionTimeoutSecs` idle timeout (set to 30 seconds). As a temporary workaround if upgrading is not immediately possible, consider placing the server behind a robust reverse proxy or Web Application Firewall (WAF) such as nginx, HAProxy, or Cloudflare, configured to buffer incomplete requests and aggressively enforce connection limits and timeouts."}], "source": {"advisory": "GHSA-ccv5-8948-c99c", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-26T16:47:44.721473Z", "id": "CVE-2026-27630", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T16:50:51.538Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27630", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-26T16:47:44.721473Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T16:47:51.396Z"}}], "cna": {"title": "TinyWeb vulnerable to Remote Denial of Service via Thread/Connection Exhaustion (Slowloris)", "source": {"advisory": "GHSA-ccv5-8948-c99c", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "maximmasiutin", "product": "TinyWeb", "versions": [{"status": "affected", "version": "< 2.02"}]}], "references": [{"url": "https://github.com/maximmasiutin/TinyWeb/security/advisories/GHSA-ccv5-8948-c99c", "name": "https://github.com/maximmasiutin/TinyWeb/security/advisories/GHSA-ccv5-8948-c99c", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/maximmasiutin/TinyWeb/commit/23268c8", "name": "https://github.com/maximmasiutin/TinyWeb/commit/23268c8", "tags": ["x_refsource_MISC"]}, {"url": "https://www.masiutin.net/tinyweb-cve-2026-27630.html", "name": "https://www.masiutin.net/tinyweb-cve-2026-27630.html", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. Versions prior to version 2.02 are vulnerable to a Denial of Service (DoS) attack known as Slowloris. The server spawns a new OS thread for every incoming connection without enforcing a maximum concurrency limit or an appropriate request timeout. An unauthenticated remote attacker can exhaust server concurrency limits and memory by opening numerous connections and sending data exceptionally slowly (e.g. 1 byte every few minutes). Anyone hosting services using TinyWeb is impacted. Version 2.02 fixes the issue. The patch introduces a `CMaxConnections` limit (set to 512) and a `CConnectionTimeoutSecs` idle timeout (set to 30 seconds). As a temporary workaround if upgrading is not immediately possible, consider placing the server behind a robust reverse proxy or Web Application Firewall (WAF) such as nginx, HAProxy, or Cloudflare, configured to buffer incomplete requests and aggressively enforce connection limits and timeouts."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400: Uncontrolled Resource Consumption"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-25T23:07:56.613Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27630", "state": "PUBLISHED", "dateUpdated": "2026-02-26T16:50:51.538Z", "dateReserved": "2026-02-20T22:02:30.028Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-25T23:05:16.563Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "TinyWeb", "vendor": "maximmasiutin", "versions": [{"status": "affected", "version": "< 2.02"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ritlabs:tinyweb:*:*:*:*:*:*:*:*", "matchCriteriaId": "8AAA8D54-16C4-42CC-A7B8-6CDCFAA96A00", "versionEndExcluding": "2.02", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. Versions prior to version 2.02 are vulnerable to a Denial of Service (DoS) attack known as Slowloris. The server spawns a new OS thread for every incoming connection without enforcing a maximum concurrency limit or an appropriate request timeout. An unauthenticated remote attacker can exhaust server concurrency limits and memory by opening numerous connections and sending data exceptionally slowly (e.g. 1 byte every few minutes). Anyone hosting services using TinyWeb is impacted. Version 2.02 fixes the issue. The patch introduces a `CMaxConnections` limit (set to 512) and a `CConnectionTimeoutSecs` idle timeout (set to 30 seconds). As a temporary workaround if upgrading is not immediately possible, consider placing the server behind a robust reverse proxy or Web Application Firewall (WAF) such as nginx, HAProxy, or Cloudflare, configured to buffer incomplete requests and aggressively enforce connection limits and timeouts."}, {"lang": "es", "value": "TinyWeb es un servidor web (HTTP, HTTPS) escrito en Delphi para Win32. Las versiones anteriores a la 2.02 son vulnerables a un ataque de denegaci\u00f3n de servicio (DoS) conocido como Slowloris. El servidor genera un nuevo hilo del sistema operativo para cada conexi\u00f3n entrante sin imponer un l\u00edmite m\u00e1ximo de concurrencia o un tiempo de espera de solicitud adecuado. Un atacante remoto no autenticado puede agotar los l\u00edmites de concurrencia del servidor y la memoria abriendo numerosas conexiones y enviando datos excepcionalmente lento (por ejemplo, 1 byte cada pocos minutos). Cualquiera que aloje servicios usando TinyWeb se ve afectado. La versi\u00f3n 2.02 corrige el problema. El parche introduce un l\u00edmite 'CMaxConnections' (establecido en 512) y un tiempo de espera de inactividad 'CConnectionTimeoutSecs' (establecido en 30 segundos). Como soluci\u00f3n alternativa temporal si la actualizaci\u00f3n no es posible de inmediato, considere colocar el servidor detr\u00e1s de un proxy inverso robusto o un cortafuegos de aplicaciones web (WAF) como nginx, HAProxy o Cloudflare, configurado para almacenar en b\u00fafer las solicitudes incompletas y aplicar agresivamente los l\u00edmites y tiempos de espera de conexi\u00f3n."}], "id": "CVE-2026-27630", "lastModified": "2026-06-17T10:27:25.280", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27630", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-26T16:47:44.721473Z", "version": "2.0.3"}}]}, "published": "2026-02-26T00:16:23.813", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/maximmasiutin/TinyWeb/commit/23268c8"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/maximmasiutin/TinyWeb/security/advisories/GHSA-ccv5-8948-c99c"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://www.masiutin.net/tinyweb-cve-2026-27630.html"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-770"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,2.02)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "TinyWeb", "source": "cna", "vendor": "maximmasiutin"}, "product": "tinyweb", "vendor": "maximmasiutin"}], "analysis": {"en": {"generated_at": "2026-04-17T14:44:32.758016+00:00", "value": {"mitigation_remediation": ["Upgrade TinyWeb to version\u00a02.02 or later, applying the built\u2011in concurrency limit and timeout settings.", "Adjust the CMaxConnections configuration to match the desired maximum number of concurrent connections, ensuring it is not set excessively high.", "Set or confirm the CConnectionTimeoutSecs idle\u2011timeout value so that threads terminate after no activity for 30 seconds.", "If an upgrade cannot be performed immediately, place TinyWeb behind a reverse proxy or Web Application Firewall such as nginx, HAProxy or Cloudflare, enabling aggressive connection limits, request buffering and idle\u2011timeout enforcement."], "summary": {"action": "Patch", "impact": "Denial of Service (DoS) via resource exhaustion"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the TinyWeb web server distributed by maximmasiutin (also listed as ritlabs:tinyweb). Versions older than 2.02 are impacted. Any deployment of TinyWeb serving websites or other HTTP services on Windows is vulnerable if it has not been updated to 2.02 or later.", "description_and_impact": "TinyWeb is a Win32 HTTP/HTTPS web server written in Delphi. Prior to version 2.02 it spawns a new OS thread for each incoming connection without imposing a maximum thread limit or an adequate request idle\u2011timeout. An unauthenticated remote attacker can open many connections and send data very slowly\u2014e.g., one byte every few minutes\u2014in order to exhaust the process\u2019s thread pool and memory, causing a denial of service. The flaw is a resource exhaustion vulnerability (CWE\u2011400) combined with an uncontrolled creation of worker threads (CWE\u2011770).", "risk_and_exploitability": "The CVSS base score is 8.7, indicating high severity. The EPSS score is below 1\u202f%, suggesting a low but non\u2011zero probability of exploitation at present; the vulnerability is not currently listed in the CISA KEV catalog. Attackers need only open multiple slow connections without authentication, making the exploit trivial to automate. If successful, the attack will consume operating system threads and memory until the server becomes unresponsive, leading to service interruption for all legitimate users."}}}}, "created": "2026-02-26T13:10:41.283641+00:00", "updated": "2026-04-17T14:45:21.044095+00:00", "vendors": ["maximmasiutin", "maximmasiutin$PRODUCT$tinyweb"]}