---
cve: "CVE-2026-29046"
severity: "CRITICAL"
cvss: 9.2
epss: "0.4%"
vendor: "maximmasiutin"
kev: false
exploited: false
published: "2026-03-06 04:16:08"
tags: [cve, security, critical]
source: tsecurity.de CVE-Dossier
exported: "2026-11-09T15:52:02+01:00"
---

# CVE-2026-29046

> 9.2 CRITICAL · 🧪 PoC

## Beschreibung

TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. Prior to version 2.04, TinyWeb accepts request header values and later maps them into CGI environment variables (HTTP_*). The parser did not strictly reject dangerous control characters in header lines and header values, including CR, LF, and NUL, and did not consistently defend against encoded forms such as %0d, %0a, and %00. This can enable header value confusion across parser boundaries and may create unsafe data in the CGI execution context. This issue has been patched in version 2.04.

## CNA-Record (Kanon, cvelistV5)

- CNA: **GitHub_M**
- State: PUBLISHED
- Stand: 2026-03-06 16:10:18
- CNA-CVSS: **9.2** (`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **none**
  - Automatable: **yes**
  - Technical Impact: **partial**

## CVSS-Vektor

```
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |

## Schwachstellen-Klasse

- **CWE-114** — Process Control
  Executing commands or loading libraries from an untrusted source or in an untrusted environment can cause an application to execute malicious commands (and payloads) on behalf of an attacker.
- **CWE-20** — Improper Input Validation
  The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- **CWE-74** — Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection)
  The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
- **CWE-93** — Improper Neutralization of CRLF Sequences
  The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

## Angriffsmuster (CAPEC)

- [CAPEC-108 — Command Line Execution through SQL Injection](https://capec.mitre.org/data/definitions/108.html) _(Severity: Very High)_
- [CAPEC-640 — Inclusion of Code in Existing Process](https://capec.mitre.org/data/definitions/640.html) _(Severity: High)_

## ATT&CK-Techniken

- [T1505.005 — Server Software Component: Terminal Services DLL](https://attack.mitre.org/techniques/T1505/005/)
- [T1574.006 — Hijack Execution Flow: Dynamic Linker Hijacking](https://attack.mitre.org/techniques/T1574/006/)
- [T1574.013 — Hijack Execution Flow: KernelCallbackTable](https://attack.mitre.org/techniques/T1574/013/)
- [T1620 — Reflective Code Loading](https://attack.mitre.org/techniques/T1620/)

## Patch verfügbar (OSV)

- 6db65cbca13cceb1f28516fc821d0134e426cc0c (Commit)
- 53aa8b6e5146491d7be57920e3fc50d7a34e4d5a (Commit)

## Referenzen

- <https://github.com/maximmasiutin/TinyWeb/security/advisories/GHSA-r3gf-pg2c-m7mc>
- <https://github.com/maximmasiutin/TinyWeb/commit/53aa8b6e5146491d7be57920e3fc50d7a34e4d5a>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2026-29046/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_