CVE-2026-28497: TinyWeb Auth Bypass Vulnerability

CVE-2026-28497 Overview

CVE-2026-28497 is a critical integer overflow vulnerability affecting TinyWeb, a lightweight HTTP/HTTPS web server written in Delphi for Win32 platforms. The vulnerability exists in the string-to-integer conversion routine (_Val) which improperly handles Content-Length header parsing. This flaw allows unauthenticated remote attackers to bypass Content-Length restrictions and perform HTTP Request Smuggling attacks, potentially leading to unauthorized access, security filter bypass, and cache poisoning.

Critical Impact
Unauthenticated remote attackers can exploit this integer overflow to bypass security controls and poison caches, with critical impact on servers using persistent connections (Keep-Alive).

Affected Products

TinyWeb versions prior to 2.03
Windows 32-bit deployments running vulnerable TinyWeb instances
Infrastructure using TinyWeb with Keep-Alive persistent connections enabled

Discovery Timeline

March 6, 2026 - CVE-2026-28497 published to NVD
March 9, 2026 - Last updated in NVD database

Technical Details for CVE-2026-28497

Vulnerability Analysis

This vulnerability stems from an integer overflow condition in TinyWeb's _Val function, which is responsible for converting string representations of numbers to integer values. When processing the Content-Length HTTP header, the function fails to properly validate numeric boundaries before conversion. This weakness is classified under CWE-190 (Integer Overflow or Wraparound).

The vulnerability is particularly dangerous because it enables HTTP Request Smuggling attacks. By crafting a malicious request with a specially designed Content-Length value that triggers the integer overflow, an attacker can cause the server to misinterpret request boundaries. This desynchronization between how the front-end and back-end systems parse HTTP requests creates opportunities for request hijacking.

The attack requires no authentication and can be executed remotely over the network with low complexity. The impact is most severe on servers configured to use persistent connections (Keep-Alive), as the connection reuse amplifies the smuggling attack's effectiveness across multiple requests.

Root Cause

The root cause lies in the _Val string-to-integer conversion routine that processes HTTP headers without proper bounds checking. When a Content-Length value exceeds the maximum integer boundary, the routine wraps around to a smaller or negative value rather than rejecting the input. This allows attackers to manipulate how the server calculates request body lengths.

Attack Vector

The attack is network-based, requiring the attacker to send specially crafted HTTP requests to a vulnerable TinyWeb server. The exploitation flow involves:

The attacker sends an HTTP request with a maliciously crafted Content-Length header value designed to trigger integer overflow
The _Val function processes this value and wraps around to an incorrect length
The server misinterprets request boundaries, treating part of the next request as body content or vice versa
This desynchronization enables request smuggling, allowing the attacker to inject malicious requests or hijack legitimate ones

The attack mechanism exploits the integer overflow in TinyWeb's Content-Length parsing. When the _Val function receives a carefully crafted numeric string that exceeds integer bounds, it wraps to an unexpected value, causing the server to miscalculate HTTP request boundaries. For detailed technical analysis, see the GitHub Security Advisory.

Detection Methods for CVE-2026-28497

Indicators of Compromise

Unusual or malformed Content-Length header values in HTTP request logs, particularly very large numbers
Desynchronized or overlapping HTTP requests in server logs indicating smuggling attempts
Unexpected request patterns where request bodies appear to contain additional HTTP headers
Cache entries containing unexpected or poisoned content

Detection Strategies

Implement web application firewall (WAF) rules to detect abnormally large Content-Length header values
Monitor for HTTP request anomalies including mismatched Content-Length and Transfer-Encoding headers
Deploy network intrusion detection signatures targeting HTTP request smuggling patterns
Use SentinelOne's network visibility capabilities to identify suspicious HTTP traffic patterns

Monitoring Recommendations

Enable detailed HTTP request logging on TinyWeb servers to capture full header information
Configure alerting for Content-Length values exceeding reasonable thresholds for your application
Monitor for signs of cache poisoning including unexpected content served from cache layers
Implement real-time log analysis to detect patterns consistent with HTTP smuggling attempts

How to Mitigate CVE-2026-28497

Immediate Actions Required

Upgrade TinyWeb to version 2.03 or later immediately
Disable Keep-Alive/persistent connections as a temporary measure if immediate patching is not possible
Place vulnerable TinyWeb instances behind a properly configured reverse proxy that normalizes HTTP requests
Review server logs for any indication of prior exploitation attempts

Patch Information

The vulnerability has been patched in TinyWeb version 2.03. The fix addresses the integer overflow condition in the _Val function to properly validate numeric boundaries during Content-Length header parsing. The patch commit is available on GitHub for review. Organizations should update to version 2.03 or the latest available version.

Workarounds

Disable HTTP Keep-Alive connections to reduce the attack surface and impact of potential smuggling attacks
Deploy a reverse proxy (such as nginx or HAProxy) in front of TinyWeb that properly validates and normalizes HTTP requests
Implement strict Content-Length header validation at the network perimeter using WAF rules
Restrict network access to TinyWeb servers to trusted IP ranges where feasible

bash

# Configuration example - Disable Keep-Alive in reverse proxy
# nginx configuration to normalize requests before proxying to TinyWeb
location / {
    proxy_pass http://tinyweb-backend;
    proxy_http_version 1.0;
    proxy_set_header Connection "";
    # Enforce strict Content-Length validation
    client_max_body_size 10m;
}