CVE-2026-29046: Ritlabs TinyWeb Header Injection Vulnerability

CVE-2026-29046 Overview

CVE-2026-29046 affects TinyWeb, a lightweight HTTP and HTTPS web server written in Delphi for Win32 by Ritlabs. Versions prior to 2.04 fail to strictly reject dangerous control characters in HTTP request headers, including carriage return (CR), line feed (LF), and NUL bytes. The parser also fails to consistently defend against encoded variants such as %0d, %0a, and %00. Because TinyWeb maps these header values into Common Gateway Interface (CGI) environment variables prefixed with HTTP_*, attackers can inject malicious content across parser boundaries. This issue is classified under [CWE-20] Improper Input Validation and is patched in version 2.04.

Critical Impact
Remote unauthenticated attackers can inject control characters into CGI environment variables, enabling header confusion attacks and unsafe data propagation into downstream CGI processes.

Affected Products

Ritlabs TinyWeb versions prior to 2.04
TinyWeb deployments serving CGI applications on Windows Win32
HTTP and HTTPS endpoints exposed through vulnerable TinyWeb instances

Discovery Timeline

2026-03-06 - CVE-2026-29046 published to the National Vulnerability Database
2026-03-16 - Last updated in NVD database

Technical Details for CVE-2026-29046

Vulnerability Analysis

The vulnerability resides in TinyWeb's HTTP header parser, which processes incoming request headers and maps them into CGI environment variables following the HTTP_* convention defined by RFC 3875. The parser does not enforce strict validation against control characters embedded in header names or values. Carriage return, line feed, and NUL bytes pass through the parsing logic without rejection. The server additionally fails to canonicalize percent-encoded representations such as %0d, %0a, and %00 before evaluating header content. This permits attackers to smuggle delimiter characters into the CGI execution boundary.

When TinyWeb passes tainted header data to CGI processes, the injected control characters can confuse downstream interpreters. CGI scripts that read environment variables may treat embedded LF sequences as record separators or misinterpret NUL-terminated strings. The result is header value confusion across parser boundaries, leading to unsafe data reaching the CGI execution context.

Root Cause

The root cause is improper input validation in the HTTP header parsing routine. TinyWeb trusts that header values conform to printable ASCII without enforcing the character set restrictions defined in RFC 7230 for HTTP message syntax. The lack of decoding-aware filtering allows percent-encoded payloads to bypass any superficial character checks.

Attack Vector

An attacker sends a crafted HTTP or HTTPS request to a vulnerable TinyWeb instance over the network. The request contains header values with embedded CR, LF, or NUL bytes, or their percent-encoded equivalents. No authentication or user interaction is required. The attack succeeds when TinyWeb forwards the unsanitized data to a CGI handler, where the injected characters alter interpretation of environment variables or output streams.

The vulnerability is described in prose only; no public exploit code or proof-of-concept has been published. Refer to the GitHub Security Advisory GHSA-r3gf-pg2c-m7mc for technical details.

Detection Methods for CVE-2026-29046

Indicators of Compromise

HTTP request logs containing raw \r, \n, or \\x00 bytes within header values
Requests containing percent-encoded sequences %0d, %0a, or %00 in header names or values
Anomalous CGI process spawns with malformed environment variable contents
Unexpected outbound responses or log entries originating from CGI scripts invoked by TinyWeb

Detection Strategies

Inspect web server access logs for header values containing non-printable characters or encoded control sequences
Deploy network intrusion detection signatures matching CR, LF, or NUL injection patterns in HTTP request headers
Audit CGI script outputs for unexpected header lines that may indicate response splitting attempts
Compare TinyWeb binary versions against the 2.04 baseline to identify unpatched deployments

Monitoring Recommendations

Enable verbose HTTP request logging on TinyWeb hosts and forward logs to a centralized analysis platform
Monitor child process creation events on Windows hosts running TinyWeb for anomalous CGI invocations
Alert on inbound HTTP requests where header values exceed expected length or contain encoded control bytes

How to Mitigate CVE-2026-29046

Immediate Actions Required

Upgrade TinyWeb to version 2.04 or later on all affected Windows hosts
Inventory all internet-facing TinyWeb deployments and prioritize patching of public-facing instances
Review CGI scripts invoked by TinyWeb for assumptions about environment variable sanitization
Restrict network access to TinyWeb management and CGI endpoints until patching is complete

Patch Information

The maintainer released the fix in TinyWeb version 2.04. The corrective commit is available at GitHub commit 53aa8b6. The patch enforces strict rejection of CR, LF, and NUL bytes in header lines and values, including their percent-encoded forms, before mapping data into CGI environment variables.

Workarounds

Place TinyWeb behind a reverse proxy or web application firewall that strips control characters from HTTP headers
Disable CGI functionality on TinyWeb instances that do not require dynamic content execution
Apply network-level filtering to block requests containing %0d, %0a, or %00 sequences in header fields

bash

# Example WAF rule fragment to block control character injection in headers
# ModSecurity-style rule
SecRule REQUEST_HEADERS "@rx (?:%0[0da]|\r|\n|\\x00)" \
  "id:1029046,phase:1,deny,status:400,\
   msg:'CVE-2026-29046 TinyWeb header control character injection'"