CVE-2026-27630: TinyWeb Slowloris DoS Vulnerability

CVE-2026-27630 Overview

CVE-2026-27630 is a Denial of Service (DoS) vulnerability affecting TinyWeb, a lightweight web server (HTTP, HTTPS) written in Delphi for Win32. Versions prior to 2.02 are vulnerable to a Slowloris attack due to the server spawning a new OS thread for every incoming connection without enforcing a maximum concurrency limit or appropriate request timeout. An unauthenticated remote attacker can exhaust server concurrency limits and memory by opening numerous connections and sending data exceptionally slowly (e.g., 1 byte every few minutes).

Critical Impact

Unauthenticated remote attackers can render TinyWeb servers completely unavailable by exhausting system resources through slow HTTP connections, impacting anyone hosting services using TinyWeb.

Affected Products

• TinyWeb versions prior to 2.02
• TinyWeb HTTP/HTTPS server for Win32

Discovery Timeline

• 2026-02-26 - CVE-2026-27630 published to NVD
• 2026-02-26 - Last updated in NVD database

Technical Details for CVE-2026-27630

Vulnerability Analysis

This vulnerability is classified as CWE-400 (Uncontrolled Resource Consumption). TinyWeb creates a new operating system thread for each incoming HTTP connection without implementing any safeguards to limit the number of concurrent connections or enforce idle timeouts. This architectural flaw allows attackers to leverage the well-known Slowloris attack technique to consume all available server resources.

The Slowloris attack works by opening multiple connections to the target server and keeping them open as long as possible by sending partial HTTP requests. The attacker sends HTTP headers very slowly, such as sending one byte every few minutes, preventing the server from closing the connection while waiting for the complete request. Since TinyWeb allocates a dedicated thread per connection, attackers can quickly exhaust the available thread pool and system memory, causing legitimate users to be denied service.

Root Cause

The root cause of this vulnerability lies in TinyWeb's connection handling architecture. The server lacked two critical protective mechanisms: a maximum connection limit to cap concurrent connections, and a connection timeout to terminate idle or slow connections. Without these controls, the server had no way to defend against resource exhaustion attacks that exploit slow data transmission.

Attack Vector

An attacker can exploit this vulnerability remotely over the network without requiring authentication. The attack is conducted by:

1. Opening numerous TCP connections to the TinyWeb server
2. Sending HTTP request data at an extremely slow rate (e.g., 1 byte every few minutes)
3. Keeping connections alive indefinitely while preventing the server from completing request processing
4. Repeating until the server exhausts available threads and memory resources

The attack requires minimal resources from the attacker's perspective while causing maximum disruption to the target server.

   
   // Unbounded Content-Length Memory Exhaustion DoS Prevention
   CMaxEntityBodySize = 10485760; // Max 10MB per request payload
+
+  // Slowloris / Thread Exhaustion DoS Prevention
+  CMaxConnections = 512;        // Max concurrent connections
+  CConnectionTimeoutSecs = 30;  // Max 30 seconds wait for HTTP request
+  
   // Buffer size for FindExecutable API result path.
   // Windows supports long paths beyond MAX_PATH (260), so we use 1000.
   CMaxExecutablePathLength = 1000;

Source: GitHub Commit Reference

The patch introduces two critical constants: CMaxConnections set to 512 to limit concurrent connections, and CConnectionTimeoutSecs set to 30 seconds to terminate idle connections waiting for HTTP request data.

Detection Methods for CVE-2026-27630

Indicators of Compromise

• Unusually high number of concurrent connections from single IP addresses or small IP ranges
• Multiple connections in a half-open or incomplete HTTP request state
• Elevated thread count and memory consumption on the TinyWeb server process
• Server becoming unresponsive to legitimate HTTP requests while showing network activity

Detection Strategies

• Monitor connection counts per source IP and alert on anomalous spikes exceeding normal baseline thresholds
• Track HTTP request completion times and flag connections that remain incomplete beyond expected timeframes
• Implement network flow analysis to identify slow-rate data transmission patterns characteristic of Slowloris attacks
• Configure IDS/IPS rules to detect multiple concurrent partial HTTP requests from single sources

Monitoring Recommendations

• Deploy real-time monitoring of TinyWeb process thread count and memory utilization
• Set up alerts for connection queue depth exceeding normal operational thresholds
• Enable web server access logging to identify patterns of incomplete requests
• Monitor network bandwidth utilization versus actual HTTP request completion ratios

How to Mitigate CVE-2026-27630

Immediate Actions Required

• Upgrade TinyWeb to version 2.02 or later immediately to receive the security fix
• If immediate upgrade is not possible, deploy TinyWeb behind a reverse proxy or WAF that buffers incomplete requests
• Implement network-level connection rate limiting per source IP address
• Review and audit any internet-facing TinyWeb deployments for signs of active exploitation

Patch Information

Version 2.02 of TinyWeb addresses this vulnerability by introducing two new protective mechanisms. The patch adds a CMaxConnections limit set to 512 concurrent connections and a CConnectionTimeoutSecs idle timeout of 30 seconds. These changes prevent attackers from exhausting server resources through slow-rate connection attacks.

For detailed information, refer to the GitHub Security Advisory and the commit implementing the fix.

Workarounds

• Place TinyWeb behind a robust reverse proxy such as nginx, HAProxy, or Cloudflare configured to buffer incomplete requests
• Configure the reverse proxy to enforce aggressive connection limits and request timeouts
• Implement firewall rules to limit the number of concurrent connections per source IP address
• Use a Web Application Firewall (WAF) with Slowloris attack detection and mitigation capabilities

# Example nginx configuration to protect backend TinyWeb server
# Place in server block configuration

# Limit connections per IP
limit_conn_zone $binary_remote_addr zone=conn_limit:10m;
limit_conn conn_limit 10;

# Set aggressive timeouts to drop slow connections
client_body_timeout 10s;
client_header_timeout 10s;
send_timeout 10s;
keepalive_timeout 15s;

# Rate limit requests
limit_req_zone $binary_remote_addr zone=req_limit:10m rate=10r/s;
limit_req zone=req_limit burst=20 nodelay;