CVE-2026-29046

🎯 CVE-2026-29046 🧪 PoC 🇪🇺 EUVD

💬 0 Diskussion 📄 .md Alle CVEs anzeigen ✕

CVE-2026-29046 | TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. Prior to version 2.04, TinyWeb accepts request header values and later maps them into CGI environment variables (HTTP_*). The parser did not strictly reject dangerous control characters in header lines and header values, including CR, LF, and NUL, and did not consistently defend against encoded forms such as %0d, %0a, and %00. This can enable header value confusion across parser boundaries and

TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. Prior to version 2.04, TinyWeb accepts request header values and later maps them into CGI environment variables (HTTP_*). The parser did not strictly reject dangerous control characters in header lines and header values, including CR, LF, and NUL, and did not consistently defend against encoded forms such as %0d, %0a, and %00. This can enable header value confusion across parser boundaries and may create unsafe data in the CGI execution context. This issue has been patched in version 2.04.

Klassifikation & Betroffenheit:

CWE-114CWE-20CWE-74CWE-93 maximmasiutin TinyWeb < 2.04ritlabs tinyweb *

Process Control

Executing commands or loading libraries from an untrusted source or in an untrusted environment can cause an application to execute malicious commands (and payloads) on behalf of an attacker.

🛡️ Empfohlene Mitigation: Libraries that are loaded should be well understood and come from a trusted source. The application can execute code contained in the native libraries, which often contain calls that are susceptible to other security problems, such as buffer overflows or command injection. All native libraries should be validated to de…

Vollständige Definition bei MITRE ➔

⚔️ Typische Angriffsmuster (CAPEC):

CAPEC-108 · Command Line Execution through SQL Injec… (Very High) CAPEC-640 · Inclusion of Code in Existing Process (High)

🎯 ATT&CK-Techniken (Kill-Chain-Verhalten):

T1505.005 · Server Software Component: Termina… T1574.006 · Hijack Execution Flow: Dynamic Lin… T1574.013 · Hijack Execution Flow: KernelCallb… T1620 · Reflective Code Loading

🧩 Ähnliche Schwachstellen (Hersteller/Klasse/Score-Band):

CVE-2026-27613 10.0 CVE-2026-22781 10.0 CVE-2025-36250 10.0 CVE-2024-56346 10.0 CVE-2025-36251 9.6

🩹 Patch verfügbar (OSV):

🩹 6db65cbca13cceb1f28516fc821d0134e426cc0c (Commit) 🩹 53aa8b6e5146491d7be57920e3fc50d7a34e4d5a (Commit)

📚 Referenzen & Quellen:

🇪🇺 Original-Eintrag (ENISA EUVD) 🇺🇸 NVD-Eintrag

Ausnutzungs-Zeitleiste:

Reserviert 2026

Veröffentlicht 03/2026

Heute 07.11.

CVSS-Vektor-Analyse: 9.2

AV · Angriffsvektor Netzwerk

AC · Komplexität Gering

PR · Privilegien Keine

UI · Interaktion Keine

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L

CNA-Bewertung (GitHub_M): 9.2 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA…

Veröffentlicht:06.03.2026

Aktualisiert:17.06.2026 10:29

Assigner (CNA):GitHub_M

EUVD-ID:EUVD-2026-9972

Quellen: 🇪🇺 EUVD-Datenbank (ENISA) + 🇺🇸 NVD-Anreicherung · 24-h-Cache

CWE-114 ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

Tier	CVEs	Anteil
≥90 %	785	0,2 %
≥50 %	3.557	0,9 %
≥10 %	13.139	3,2 %
<10 %	391.261	95,7 %

Tier

CVEs

Anteil

≥90 %

785

0,2 %

≥50 %

3.557

0,9 %

≥10 %

13.139

3,2 %

<10 %

391.261

95,7 %

9.2 CRITICAL

EPSS

0.4%

CVE-2026-29046 🌐 Netzwerk (Remote) 🔓 Keine Authentifizierung nötig

maximmasiutin

CVE-2026-29046 | TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. Prior to version 2.04, TinyWeb accepts request header values and later maps them into CGI environment variables (HTTP_*). The parser did not strictly reject dangerous control characters in header lines and header values, including CR, LF, and NUL, and did not consistently defend against encoded forms such as %0d, %0a, and %00. This can enable header value confusion across parser boundaries and

CWE-114 ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

vor 8 Monaten ↻ vor 8 Monaten

🛡️ Details ➔

Zero-Day & Vulnerability Intelligence Hub