CVE-2026-28497 Overview
CVE-2026-28497 is an integer overflow vulnerability in TinyWeb, a Win32 HTTP/HTTPS server written in Delphi. The flaw resides in the _Val string-to-integer conversion routine used to parse the Content-Length header. Unauthenticated remote attackers can overflow the integer parser to bypass Content-Length restrictions and perform HTTP Request Smuggling. Successful exploitation enables unauthorized access, security filter bypass, and cache poisoning. The impact is most severe on servers using persistent connections (Keep-Alive). All versions prior to 2.03 are affected, and the maintainer fixed the issue in version 2.03.
Critical Impact
Unauthenticated attackers can smuggle HTTP requests through TinyWeb, bypassing security filters and poisoning downstream caches.
Affected Products
- Ritlabs TinyWeb versions prior to 2.03
- TinyWeb HTTP server component (Win32 Delphi build)
- Deployments using HTTP Keep-Alive persistent connections
Discovery Timeline
- 2026-03-06 - CVE-2026-28497 published to NVD
- 2026-03-16 - Last updated in NVD database
Technical Details for CVE-2026-28497
Vulnerability Analysis
The vulnerability is classified as an integer overflow [CWE-190] in TinyWeb's request parser. When TinyWeb processes the Content-Length header, the _Val routine converts the ASCII numeric string into an integer without enforcing upper bounds. An attacker can submit a Content-Length value that exceeds the maximum representable integer, causing the parsed value to wrap to a small or negative number. The server then reads fewer bytes than the attacker actually sent, leaving residual data in the TCP stream.
On Keep-Alive connections, that residual data is interpreted as the beginning of the next HTTP request. This desynchronizes the server's request boundary from the client's, the defining condition for HTTP Request Smuggling.
Root Cause
The _Val function lacks overflow checking when converting Content-Length strings to integers. Delphi's native integer types silently wrap on overflow, and TinyWeb trusts the resulting value as the authoritative body length. No validation rejects oversized numeric strings or negative results before they reach the body-reading loop.
Attack Vector
The attack is remote, network-based, and requires no authentication or user interaction. An attacker crafts an HTTP request with a Content-Length header containing an integer string large enough to overflow the parser. The request body contains a smuggled second request appended after the byte count the server expects to read. When TinyWeb finishes processing the first request on a persistent connection, it parses the smuggled bytes as a new, attacker-controlled request. Intermediate caches and security filters see only the outer request, allowing the smuggled request to bypass them.
No verified public exploit code is available. See the GitHub Security Advisory and the patch commit for technical details.
Detection Methods for CVE-2026-28497
Indicators of Compromise
- HTTP requests containing Content-Length header values exceeding 2,147,483,647 or with unusually long numeric strings.
- Multiple Content-Length headers, negative values, or Content-Length combined with Transfer-Encoding on the same request.
- TinyWeb access logs showing back-to-back requests on a Keep-Alive connection where the second request method or path does not match any client-originated traffic.
Detection Strategies
- Deploy a reverse proxy or web application firewall in front of TinyWeb that normalizes and re-emits Content-Length headers, rejecting non-canonical numeric values.
- Inspect raw TCP streams to TinyWeb for request boundary anomalies, particularly trailing bytes after a declared body length.
- Alert on TinyWeb processes serving requests where the parsed Content-Length differs from the byte count observed on the wire.
Monitoring Recommendations
- Log full request headers and connection identifiers so smuggled requests can be correlated to their carrier connection.
- Monitor cache infrastructure for poisoned entries by comparing response hashes against expected content for given URLs.
- Track TinyWeb version strings across the estate to confirm all instances are running 2.03 or later.
How to Mitigate CVE-2026-28497
Immediate Actions Required
- Upgrade all TinyWeb instances to version 2.03, which contains the fix for the _Val integer overflow.
- Disable HTTP Keep-Alive on TinyWeb until the upgrade is complete to eliminate the persistent-connection precondition for smuggling.
- Place TinyWeb behind a hardened reverse proxy that strictly validates Content-Length and rejects ambiguous framing.
Patch Information
The maintainer released TinyWeb 2.03 with the fix delivered in commit d2edd0322c3d74beee0a6c0191299b8946695d4e. The patch adds bounds checking to the _Val conversion routine so oversized or malformed numeric strings are rejected before being used as a body length. Details are documented in the GitHub Security Advisory GHSA-rp8j-cx7r-mw9f.
Workarounds
- Front TinyWeb with a proxy such as nginx or HAProxy configured to enforce strict HTTP/1.1 framing and a sane client_max_body_size.
- Drop requests at the network edge where Content-Length exceeds the server's documented maximum request size.
- Force Connection: close on TinyWeb responses to prevent attackers from smuggling a second request onto the same TCP session.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
